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a way that there would be no rejections upon inspection and 
test. 

The manufacturer would assure the quality before work 
commenced, the concept was called “Quality Assurance” 
(QA). 


2.4 Quality Assurance 


QA is defined as all those planned and systematic actions 
necessary to provide adequate confidence that a product or 
service will satisfy given requirements for quality. 

The basic concept being “getting it right before you start”. 

Since everyone in a manufacturing works or service organ- 
isation is concerned either directly or indirectly with the 
attainment of quality it follows that everyone is concerned 
with QA, ie “Quality is everybody’s business”. 

In establishing a QA system the first task of management 
is to define the company’s Quality Policy and Objectives and 
make everyone aware of them. 

The Lloyd’s Register Quality Policy and Objectives are 
contained in the Corporate Quality Manual. See Figs. | and 2. 


2.5 Quality Assurance Standards 


In establishing Quality Systems many organisations have 
specified the disciplines and activities that they consider to be 
important to ensure the correct quality in the products or 
services delivered by them. 

One of the earliest was the North Atlantic Treaty 
Organisation (NATO) which published AQAP-1, the NATO 
quality control system requirements for industry in May 1968. 
This was utilised in the Ministry of Defence (M.O.D.) DEF 
STAN 05-8 in March 1970. 

From these were developed the M.O.D. standards: 


DEF STAN 05-21 (1973 revised 1976 - now AQAP-1 Edn3) 
05-24 
05-29 


and the following British Standards: 


BS 5179 Guide to the Operation and Evaluation of Quality 
Assurance Systems (1974 withdrawn 1981) 

BS 5750 Parts 1, 2, 3 (1979) 
Parts 4, 5, 6 (1981) 


BS 5750 rapidly established its position as the world leader 
and because of wide international acceptance became the 
basis for the development of the ISO 9000 series of standards 
first published in 1987. BS 5750 and the ISO 9000 series are 
now identical and have become dual numbered in the interests 
of international harmonisation. The documents have also 
become European Standards with each part having an EN 
designation allocated. 

For example the following standards are identical: 


BS 5750 Part 1 
ISO 9001 
EN 29001 


This international recognition is important and will rein- 
force the efforts of organisations such as ours which compete 
in overseas markets. 

The 1987 revisions of the standards came into effect from 
29th May 1987 and are as follows: 


BS 5750 

Part 0 Sect 0.1 (ISO 9000) Guide to Selection and Use. 
Part 0 Sect 0.2 (ISO 9004) Guide to Quality Management 
and Quality System Elements. 

Part | (ISO 9001) — Specification for Design/Development, 
Production, Installation. 

Part 2 (ISO 9002) — Specification for Production and 
Installation. 

Part 3 (ISO 9003) — Specification for Final Inspection and 
Test. 


Since 1990 the following standards have been confirmed in the 
BS 5750 Series: 


Part 41990 Guide to the use of BS 5750 Part 1, 2 and 3. 


Part8 1991 Guide to Quality Management and Quality 
(ISO 9004-2) Elements for Services. 


Part 13 1991 Guide to the Application of BS5750: Part 1 to 
(ISO 9000-3) the Development, Supply and Maintenance 
of Software. 


Also in 1990 the quality standard: 


BS 5882 Specification for a Total Quality Assurance 
Programme for Nuclear Installations was 


confirmed. 


In 1991 the following quality vocabulary standards were 
confirmed: 


BS 4778: Quality Vocabulary 
Part 2: Quality Concepts and Related Definitions 
Part 3: Availability, Reliability and Maintain- 


ability Terms 
Part 3 Sect 3.1 Guide to Concepts and Related Definitions 
Part 3 Sect 3.2 Glossary of International Terms 


With the emergence of the ISO 9000 series of Quality 
Standards in 1987 it became clear to NATO that there would 
be merit in adopting the ISO 9000 series for use by nations in 
their OA activities. In 1988 it was decided that work would start 
on a new series of AQAPs which would embrace the require- 
ments of the ISO 9000 series and those additional 
contractual/surveillance requirements of the existing AOQAPs. 

The M.O.D. has introduced a new series of defence stan- 
dards for contractual purposes. 


DEF STAN TEESE REPLACES 

05-91 Quality System Requirements AQAP-1 
for Design/Development, including 
Production Installation AQAP-6 


and Servicing 
(This Defence Standard adopts ISO 9001:1987 and 
includes supplementary requirements) 


05-92 Quality System Requirements AQAP-4 
for Production and including 
Installation AQAP-6 


(This Defence Standard adopts ISO 9002:1987 and 
includes supplementary requirements) 


05-93 Quality System Requirements AQAP-9 
Final Inspection and Test 

(This Defence Standard adopts ISO 9003:1987 and 

includes supplementary requirements) 


STATEMENT OF LR’S OBJECTIVES 


. LR’s central purpose is to play a leading role in the setting, maintenance and 


application of proper standards of safety and quality in the world’s shipping 
and offshore industries, by means of classification, certification and technical 
research. 


. LR will continue the positive development of services designed to achieve 


or promote standards of safety and quality in other industries world-wide, 
especially when such services draw upon or develop the skills possessed 
by LR and when they make a contribution to offsetting the costs of LR’s 
central services. 


. LR will continue to provide services which, although not specifically aimed 


at promoting proper standards of quality and safety, are closely linked with 
objectives 1 and 2, notably the provision of statistical information and 
publishing services. 


. Taking all these areas of activity together, LR will aim to break even on 


operating account and to maintain proper financial strength to guard 
against short-term fluctuations in operating results. 


. LR will continue to disseminate technical information throughout the indus- 


tries which it serves, support and encourage technical research and 
education and contribute technical papers to international journals and 
conferences. 


. LR’s objectives will be achieved by continuing the steady recruitment, 


training and development of a world-wide team of skilled and committed 


rewarded careers with LR. 


staff, who can look forward to challenging, satisfying and properly 
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Fig. 2 The Lloyd’s Register Statement of Objectives 


05-94 Guide for the Implementation AQAP-2, 
of Defence Standards AQAP-5 
05-91, 05-92 and AQAP-7 
05-95 Quality System Requirements AQAP-13 


INTERIM _ the Development, Supply and 
Maintenance of Software 

(This Defence Standard adopts selected requirements 

from ISO 9001 and includes selected guidance text from 

ISO 9000-3:1991 converted into requirements together 

with supplementary requirements) 


Ina DGDQA special bulletin details were given of changes 
in M.O.D. policies relating to Quality Assessment. These 
changes required suppliers of products or services, for which 
there were Quality Control/Inspection requirements, to obtain 
certification from an NACCB accredited Third Party 
Certification Body. This certification to be to an appropriate 
ISO 9000/BS5750 series standard which would be acceptable 
to the M.O.D. The M.O.D. agreed they would also base the 
contractual and surveillance activities on the ISO 9000 series 
of quality standards. (The M.O.D. have assessed Lloyd’s 
Register to AQAP-1 and have verbally stated that they will 
continue to monitor Lloyd’s Register to this standard for the 
foreseeable future, see paragraph 8.1 below.) 


3. QUALITY ASSURANCE IN LLOYD’S 
REGISTER 


3.1 Historical 


Lloyd’s Register has been involved with quality from its incep- 
tion. In 1896 Lloyd’s Register produced an “Approved Supplier 
List”. 

In 1968 a Quality Approval Scheme was developed to deal 
with mass produced machinery, and in 1973 QA schemes were 
introduced for Engineering Materials and Shipbuilding. The 
early approvals under these schemes were awarded in Japan, 
USA and Scandinavia. 

Quality Schemes now operated by Lloyd’s Register now 
include: 


(1) Quality Assurance Scheme for the Hull Construction of 
Ships. 

(2) Quality Assurance Scheme for Machinery. 

(3) Quality Assurance Scheme for Materials. 

(4) Quality Scheme for Produced Certification by Surveillance 
of Quality Systems. 


Contracts awarded in the Industrial Division and later in the 
Offshore division required Lloyd’s Register to establish 


The Corporate Quality Manager is responsible to the 
Corporate Quality Director for co-ordinating the development, 
documentation and maintenance of the Quality System 
throughout Lloyd’s Register. 

In each Headquarters Division (Ship, Industrial, Offshore 
and Engineering Services Group), and in each Region, Quality 
Officers are appointed, who are responsible to their Divisional 
or Regional Managers for ensuring that the Corporate Quality 
System is developed, documented and maintained in their 
Divisions or Regions in accordance with the requirements of 
the Quality System. 

These Quality Officers are responsible to their line 
managers but also have a communication line up to the 
Corporate Quality Committee through the Corporate Quality 
Manager. 

In those areas responsible to UK based Regional Managers, 
the Regional Managers themselves are the Quality Officers. 

Fig. 3 shows the Quality Assurance Organisation. 


CORPORATE QUALITY 
MANAGEMENT 


CORPORATE QUALITY 
COMMITTEE MEMBERS: 
The Chairman 
The Chief Engineer Surveyor 


4. DOCUMENTATION 


4.1 The Structure 


A hierarchical structure of documentation has been devised for 
the Quality System which is described in the Corporate Quality 
Procedure OS 02-01-B01. This Procedure was issued to all 
Quality Officers with a memorandum from Corporate Quality 
Assurance (COA) on 9th March 1989 requesting that docu- 
mentation of the system should proceed. 

The Lloyd’s Register Quality Programme (Documentation) 
consists of: 


QS 01-00 
QOS 02-00 


The Specification of Requirements 
The Corporate Quality Manual 
The Corporate Quality 


Procedures Manual OS 02-01 
The Software OA Procedures OS 02-02 
The Finite Element QA Procedures QOS 02-03 


Divisional and Regional Organisation 
and Procedures Manual 

Departmental and Outport Organisation 
and Procedures Manuals 


OS 03-Series 


LINE 
MANAGEMENT 


HQ MANAGEMENT 
STRUCTURE 


The Chief Ship Surveyor 
The Corporate Quality Director 
The Secretary 
THE CORPORATE REGIONAL MANAGEMENT 
QUALITY DIRECTOR rere STRUCTURE 
THE CORPORATE 
QUALITY MANAGER DIVISIONAL MANAGERS REGIONAL MANAGERS 
| __Communication Line __ QUALITY OFFICERS 
; (In each HQ Division) 
; Communication Line QUALITY OFFICERS 


(In each Region) 


Fig. 3 The Quality Assurance Organisation 


Documents cross-referenced in the Quality System include: 


LR Rules and Regulations 

National and International Standards and Codes 
Survey Procedures Manual 

Administrative Procedures Manual 
Communications Manual 

Technical Notices 

Administrative Notices 

Specific Work Instructions 


Fig. 4 shows the QA Documentation Structure. 


1SO 9001 


LR SPECIFICATION 
OF REQUIREMENTS 
QS 01 - 00 


LR CORPORATE 
QUALITY MANUAL 
QS 02 - 00 


4.2 The Corporate Quality Manual QS 02-00 


The Corporate Quality Manual, OS 02-00 first issued in 1986, 
has been extensively revised and rewritten. Revision 1 was 
distributed in December 1989. A second revision was issued in 


June 1991. 


The Corporate Quality Manual contains statements detail- 


ing the following: 


Manual Identification 
Policy Statement 

The Quality System 
Scope 
Confidentiality 


LR CORPORATE 
QUALITY 
PROCEDURES MANUAL 
QS 02 - 01 
SOFTWARE QA THE FINITE ELEMENT 
PROCEDURES QA PROCEDURES 
QS 02 - 02 QS 02 - 03 
DIVISIONAL REGIONAL 
ORGANISATIONAL AND ORGANISATIONAL AND 
PROCEDURES MANUALS PROCEDURES MANUALS 
QS 03 etc. QS 10 etc. 
DEPARTMENTAL LOCAL OFFICES 
ORGANISATION AND. ORGANISATION AND 
PROCEDURES MANUALS PROCEDURES MANUALS 


Fig. 4 The Quality Assurance Documentation Structure 
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Organisation 

Responsibilities 

Personnel 

Documentation 

Records 

Maintenance of the Quality System 

Work Control 

Contract Reviews 

Handling, Packing and Delivery 

Non-Compliances, corrective actions and complaints 
Sub-Coniracting 

Quality Audits of Lloyd’s Register by other Organisations 


Appendices 
Manual Administration 
Revision List 
Definitions 
Cross Reference Table 
Distribution List (Controlled Copies) 


In June 1991 asupplement to the Corporate Quality Manual 
was issued for compliance with the MOD Standard AQAP-1 
detailing the following: 


Manual Identification 
Contents 
Amendment Record 


Introduction 

Scope 

Documentation 

Maintenance of the Quality System 

Process Control 

Contract Review 

Design/Design Appraisal Control 

Purchasing 

Control of Non-Conforming Product (Non- 
Compliance/Corrective Actions and Complaints) 
10. Inspection and Testing 

11. Inspection and Test Status 

12. Office Accommodation and Assistance for QAR 


Se 


eee 


It is anticipated that the contents of this supplement will be 
incorporated into the Corporate Quality Manual during 1992. 


4.3 Specifying a Standard Form of Procedure 


The format for a standardised procedure, Quality System 
Procedures, Preparation, Approval and Issue OS 02-01-B02 
was issued to all Quality Officers on 9th March 1989. 

It is required that all procedures state the following: 


1) Scope: 
The extent to which the procedure is applicable eg. to an 
Office, a Region or a Division. 
2) Objective: 
What is to be achieved. 
3) Timing: 
When the work has to be done. 
4) References: 
The standards and other documents with which there must 
be compliance. 
5) Responsibilities: 
The persons responsible for each stage of the work. 
6) Method: 
How the work is to be done. 
7) Verification: 
How and by whom it will be verified that the work has been 
done correctly. 


8) Records: 
How and where it will be recorded that the work has been 
done. 


Reference any documents to be issued. 


4.4 Preparation of Corporate Quality Procedures 

A Corporate Quality Procedures Manual OS 02-01 was 
issued officially on Ist June 1991 

The Contents include: 


QOS 02-01-A01 
QOS 02-01-B01 


The Corporate Quality Committee 
Quality System Documentation 
Quality System Procedures, 
Preparation, Approval and Issue 
In House Quality System Audits 
Management Reviews for the 
In-House Quality System 

Model Procedure 

In House Quality System Auditors 
Qualifications 

Auditing Surveyors Work 

In Outports 


QOS 02-01-B02 
OS 02-01-B04 


QOS 02-01-B0S 
OS 02-01-B06 


OS 02-01-B07 
OS 02-01-B08 


In September 1991 a supplement to the Corporate Quality 
Procedures Manual for compliance with AQAP-1 (Edition 3) 
QS 02-01-01-MOD was issued containing the following: 


Procedure for Project Management OS 02-01-01-MOD1 
Procedure for Preparation of 
Quality Plans 

Procedure for Concessions and 
Production Permits 

Procedure for Establishing and 
Maintaining a Project Library 


QS 02-01-01-MOD2 
QS 02-01-01-MOD3 
QOS 02-01-01-MOD4 


It is anticipated that these procedures will be incorporated 
into the Corporate Quality Procedures Manual at the next revi- 
sion together with procedures for: 


a) Control of Surveyors Stamps 
b) Assessment and Control of Sub Contractors 


4.5 Software QA Manual 


In 1987 an Lloyd’s Register “in-house” report recommended 
that Software Quality Assurance Procedures be developed, 
issued and implemented. In 1989 Revision 1.0 was issued and 
over the intervening period these procedures have been 
progressively developed. Revision 1.3 will be issued in late 1992. 


4.6 Finite Element Analysis QA Manual 


Drafting of the Finite Element Analysis Quality Assurance 
Procedures commenced in 1987 and these have been progres- 
sively developed and it is expected that the final document will 
be issued in late 1992. 


4.7 Divisional/Departmental/Regional/Country/Local Office 
Manuals 


Good progress has been made in producing the required organ- 
isation and Procedures Manuals in the Divisions, Regions, 
Offices, etc. as defined in the Procedure Quality System 
Documentation QS 02-01-B01. 


5. AUDITING 


5.1 The Quality Audit 


An audit is a systematic and independent examination to 
determine whether quality activities and related results 
comply with planned arrangements and whether the arrange- 
ments are implemented effectively and are suitable to achieve 
the objectives. 


5.2 Reasons for Auditing 


Audits are held for a number of reasons, such as: 


1. Toprovide managementatall levels with an in depth look 
at the organisation. 

2. To verify that systems exist to enable Lloyd’s Register to 
meet its contract requirements. 

3. To check existing systems against a known standard and 
highlight weak points with a view to correcting them. 

4. To ensure that existing procedures are being followed. 

To meet customers/clients demand for Quality Auditing. 

6. To meet the Quality standards demand for Quality 
Auditing. 


a 


If Quality System Auditing is used correctly it should: 


1. Produce real information for use in making management 
decisions. 

2. Identify if and where improvements or changes are 
needed. 

3. Contribute to Lloyd’s Register’s continual improvement. 

4. Confirm that we are already doing well. 


5.3 Auditing the Lloyd’s Register “In-House” Quality 
System 


A hierarchical structure of quality system audits has been 
devised. This structure requires each Divisional Manager and 
each Regional Manager to arrange audits throughout their 
Divisions or Regions in a systematic way, in accordance with 
procedure OS 02-01-B04 issued to all quality officers on 
11th April 1989. 

Auditing is proceeding in all Lloyd’s Register Divisional 
and Exclusive outport offices. 

In its original form the procedure called for each Lloyd’s 
Register office to be audited biannually as a minimum. In June 
1991 the procedure was amended to require the following 
system of auditing: 


Audits which cover all aspects of the work of the office, 
both technical and administrative. No office is to be with- 
out an audit for more than 3 years. Audits are led by 
Surveyor Auditors. 


Intermediate Audits which cover all administrative func- 
tions of the office. No office is to be without an 
intermediate audit for more than | year. Intermediate 
audits may be led by Surveyor or Senior Administrative 
Officer Auditors. 

Corporate Audits are held at random intervals to verify 
the effectiveness of the audit system, and are carried out 
by the Corporate Quality Assurance Department 
(CQA). 


The Chief Surveyors may call for an audit at any time. 
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5.4 Selection and Training of Auditors 


It is a Lloyd’s Register “in-house” QA System rule that only 
trained auditors may audit Lloyd’s Register offices. 

The behavioural aspects of an auditor’s “make up” are as 
important as his or her technical “know how”. They may have 
to carry out audits in many areas with differing disciplines, they 
should not be of junior status and must have the qualities which 
will enable them to deal with all levels of personnel in the 
organisation. 

The procedure for the qualification of “in-house” Quality 
System Auditors is contained in the Corporate Quality 
Procedure QS 02-01-B07. 

Lloyd’s Register satisfies itself that the necessary training in 
the audit techniques of its own “in-house” Quality System 
Auditors has been satisfactory completed by assessment and 
examination during the “in-house” QA System courses run by 
the Training Department. 

Two types of courses are run: 


a) The Auditor Course, which qualifies auditors and provides 
instruction in the production of Quality Systems documen- 
tation and how to receive audits. 

b) The Lead Auditors Course, which qualifies persons to lead 
Audits and Intermediate Audits and gives instructions on 
how these audits are to be managed and reported. 


The nomination of candidates for the courses are made to 
the Training Department by local managers. Each course is run 
over a five day period and certificates are issued to successful 
candidates. 

The following external courses also satisfy the 
Lloyd’s Register requirements for training in audit techniques: 


1. Portsmouth Management Centre course Quality System 
Assessments and Audits. 

2. Equivalent courses at Sheffield Polytechnic and Cranfield 
College. 


5.5 Quality Audits of Lloyd’s Register by other Organisations 
(Admitted Audits) 


These Quality Audits of Lloyd’s Register by clients, acceptable 
client nominees or other external bodies who act on behalf of 
national schemes are referred to as admitted audits. 

Over the last two years external admitted audits on Lloyd’s 
Register have included those carried out by the following 
organisations: 


The UK Ministry of Defence 

The Engineering Inspection Authorities Board 
Nuclear Electric 

Shell UK Materials Services. 

The UK Department of Transport. 

The Norwegian Maritime Directorate 
Property Services Agency 

Department of Energy 

9. Maritime Transport —- New Zealand 

10. MCCR Ontario 

11. Institute of Mechanical Engineers 

12. Emerald Field Development - Management Services 
13. Drillings U.S.A. 

14. South African Bureau of Standards (S.A.B.S.) 
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6. SUSTAINING THE QUALITY SYSTEM 


In the previous section the auditing system is discussed. An 
essential part of all quality systems are the feedback systems 
which provide management with data on how and where effort 
should be put in making the system work. This also gives infor- 
mation on how the system should be adapted to meet real 
management needs, these are the processes by which the system 
is sustained. 
The main categories of feedback are: 


a) Auditing 
b) Management Reviews 
c) Monitoring 


6.1 Auditing 


See Section 5 above. 


6.2 Management Reviews 


Management Reviews are carried out at the discretion of 
Managers to ensure that the “in-house” Quality System is 
subject to periodic and comprehensive reviews, that Lloyd’s 
Register quality objectives are being achieved and to change 
the system when changes are needed. 

Reviews are carried out: 


In each Office or Department 
In each Division 

In each Region 

In Lloyd’s Register (Corporate) 


The interval between Reviews at any location shall not 
exceed 12 months and the review shall have an agenda based 
on the requirements of procedure OS 01-BOS5 and shall be 
minuted. 


6.3 Monitoring 


Monitoring is carried out on an ongoing basis and includes: 


1) Document Monitoring 
2) System Monitoring 
3) Activity Monitoring of Field Surveyors 


Document Monitoring is a regular examination of samples 
of each type of document produced within a location. 

These examinations verify the accuracy and completeness 
of the documents, the samples examined are endorsed and 
records kept. 

System Monitoring includes regular examination of samples 
of job files, control records and computerised records. 

Activity Monitoring of field force surveyors includes regular 
witnessing by the head of the location or someone assigned by 
him of the practices of field surveyors performing their duties. 
Records of the activities witnessed are kept by both parties. 

The procedure OS 02-01-B08 details the methods of moni- 
toring field surveyors activities. 


7. IMPLEMENTATION 


The Quality System is now being implemented. Good progress 
has been made in completing the required documentation and 
in maintaining the system by means of auditing and monitoring 
throughout Headquarters and the Outports. 


8. ASSESSMENTS BY EXTERNAL BODIES 


8.1 The UK Ministry of Defence 


The Engineering Services Group and the UK Outports of 
Lloyd’s Register have been assessed to the QA Standard 
AQOAP-1 by the UK M.O.D. This assessment has enabled LR 
to be included on the Defence Contractors List to supply the 
following services: 


a) Design studies, appraisal, evaluation and support for ships 
and ship systems. 

b) Project management for ship refit, repair, build, installa- 
tion and commissioning. 

c) Preparation or assistance in preparation of refit and revi- 
sion specifications for auxiliary craft and associated 
procurement, inspection, test and survey. 


8.2 The Engineering Inspection Authorities Board 


The Industrial Division of Lloyd’s Register has been assessed 
by the Engineering Inspection Authorities Board (EIAB), and 
granted approval in respect of BS 5750 Part 1 1987, ISO 9001 
and EN 29001 for the inspection, verification of design and 
certification of boilers and pressure vessels, inspection and 
certification of associated material and components. 


8.3 The South African Bureau of Standards 


The Management System of the South African Offices of 
Lloyd’s Register have been successfully assessed by the South 
African Bureau of Standards (SABS) and found to comply with 
the code of practice SABS 0227. 


8.4 The International Association of Classification Societies 
Quality System Certification Scheme 


Lloyd’s Register, as a member, is involved within the 
International Association of Classification Societies (IACS) in 
setting up an [ACS accreditation body which will assess and 
certify the constituent members in accordance with its own 
Quality System Certification Scheme based on the Quality 
Standard ISO 9004 as applicable, which was approved by the 
IACS Council in June 1991. 

Lloyd’s Register aims to have its “in-house” QA System fully 
documented with a proven track record of Audits, 
Management Reviews and Monitoring Records by the end of 
1992, with a view to applying to IACS for assessment by 
Ist January 1993. 

If a comparison is made of the requirements of the [ACS 
Quality System Certification Scheme and the Lloyd’s Register 
“in-house” Quality System Specification of Requirements, 
QS 01-00 Revision 2 (see Appendix A), then it will be seen that 
if we are able to demonstrate that we can satisfy our own 
requirements then we can also satisfy the [ACS requirements. 


MINISTRY OF DEFENCE 


Cality Vasurance Beard 


Shas is to Cory that 


LLOYDS REGISTER OF SHIPPING 
71 FENCHURCH STREET 
LONDON 
EC3M 4BS 


tas teen registered as complying with the 
spoofed tn 


AQAP 1 EDITION 3 


Kegistation Nei 


1H1L01 


This Registration is valid until 
JUNE 1994 


and covers the 
products/services for which t 


you have been assessed. 


DIRECTOR GENERAL OF DEFENCE QUALITY ASSURANCE 


fees ech, Coe 


DIRECTOR QUALITY ASSURANCE / OPERATIONS 
> CONTRACTOR ASSESSMENT SPONSOR 


Fig. 5 The Certificate of Compliance with AQAP-1 Edition 3 issued by the Director General of Defence Quality Assurance 
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CERTIFICATE OF APPROVAL 


Engineering Inspection Authorities Board 


A Board of the Institution of Mechanical Engineers 


This is to certify that the quality management arrangements of 


LLOYDS REGISTER INDUSTRIAL DIVISION 
OF LLOYDS REGISTER OF SHIPPING 


have been assessed by and granted approval by the EIAB in respei 


the requirements of BS 5750 Part 1 1987, ISO 9001 and EN 29001 
for the inspection, verification of design and certification of boilers 
and pressure vessels. Inspection and certification 
of associated matcrials and components 


Subject to evidence of continued satisfactory operation, 
this certificate is valid until 


25 June 1994 
Date of issue Certificate No. 


5 September 1991 02 


Signed Chairman EIAB 


Engineering 
Inspection 
Authorities 
Board 


A Board of the Institution of 
Mechanical Engineers 


Fig. 6 The Certificate of Assessment and Approval to BS 5750, [SO 9001 and EN 29001 
issued by the Engineering Inspection Authorities Board 


9, THE BENEFITS AND COSTS OF A QA 
SYSTEM TO LR 


9.1 Benefits 


When making the decision to install a QA System within Lloyd’s 
Register the base premise made by Management was that the 
system should produce real benefits which would exceed the 
costs. 

The direct benefits of QA, just as of marketing and adver- 
tising, in gaining extra business are difficult to calculate. 

One of the main advantages of a OA system is not having 
the disadvantage of being without it! In many cases contracts 
would not be awarded if we did not have a QA system in place. 

On the marine side of our work many organisations for 
whom we carry out statutory surveys and on whose behalf we 
issue certification, now require that we have a QA system in 
place, and call upon us to demonstrate our capability when 
carrying out audits of Lloyd’s Register. 

Lloyd’s Register will be required by IACS to demonstrate 
during audit of our marine and offshore operations, our capa- 
bility to satisfy the requirements of the LACS Quality System 
Certification Scheme. Participation in the [ACS Quality 
System Certification Scheme is mandatory for member 
Societies. 

In the Industrial and Offshore Divisions many contracts 
would not be awarded to us if we were not able to demonstrate 
we had a QA system in place. 

In these times when our competitors are offering basically 
similar sounding services for similar or even lower fees, then it 
is essential for us to to be able to demonstrate that we can offer 
our clients a quality service which is second to none. 

Whilst there are costs associated with implementing the 
Quality System it is considered that QA will produce tangible 
benefits which can be identified as follows: 


1. More efficient performance leading to: 
1.1 A reduction of failures leading to: 
1.2 Reduced costs of rectification 


2. Improvement in the quality of our service resulting in: 
2.1 Improved client relationship. 


3. The service provided throughout the world will be of a 
more consistent quality. 


4. Staff moving from one location to another will be more 
familiar with working practices. 


5. For new personnel written procedures will be in place 
therefore. 
5.1 Time spent on induction/training can be kept to a 
minimum. 


6. Review of our practices while documenting or revising our 
procedures may reveal potential economies. 


7. Morale is generally improved as the duties and responsi- 
bilities of personnel are well documented and understood. 


9.2 Costs 


The costs associated with implementing and maintaining the 
Quality System include the following: 


1) Fees paid to Certification/Assessment Bodies 

2) Time spent by staff in generating documentation 
3) Time spent by staff introducing the system 

4) Costs of maintaining the system 

5) Costs of internal and external audits 

6) Costs of Management Reviews 


10. CONCLUSION 


As stated in the Quality Policy it is Lloyd’s Registers objective 
to maintain and continually enhance its high standards, which 
have been established over the years with its clients. The estab- 
lishment of, and commitment to, the “in-house” Quality System 
provides the means by which Lloyd's Register is able to demon- 
strate to clients and other organisations that we can meet their 
requirements for a quality service. Lloyd’s Register has always 
given a quality service, the difference being that we are now 
being requested to formally demonstrate this. The staff of 
Lloyd’s Register have always been quality minded, and given 
this state of mind the procedures and instructions associated 
with the Lloyd’s Register Quality Assurance System can be 
valuable adjuncts in securing efficient as well as effective 
control. 


Appendix A 


LLOYD’S REGISTER SPECIFICATION OF 
REQUIREMENTS 


DOCUMENT QS 01-00 REVISION 2 


Contents 


|. Basis of Requirements and Comparisons with ISO 9001, 
IACS, AQAP-1 and BS 5882 

2. Definitions 

3. Management Responsibility 

4. Organisation and Responsibilities 

5. The Quality System 

6. Contract Review 

7. Design Control 

8. Control of Rules and Regulations 

9. Document Control 

10. Purchasing 

11. Subcontracting 

12. Purchaser Supplied Product 

13. Job/Product Identification Status and Traceability 

14. Work Control 

15. Inspection and Testing 

16. Inspection Measuring and Test Equipment 

17. Inspection and Test Status 

18. Control of Non-Conforming Purchased Product 

19. Handling, Storage, Packing and Delivery 

20. Records 

21. Internal Quality Audits 

22. Non-Compliance and Corrective Actions 

23. Management Reviews 

24. Training 

25. Statistical Techniques 

26. Accommodation and Assistance for Clients QAR 


NOTE 

In LR, sections (10), (12) (15), (18) and (26) are only applicable 
to offices/departments engaged with UK MOD work to 
AQAP-1. In addition section (12) is applicable to software. 


The paragraphs shown in italics indicate the requirements of 
the standards 1S0 9001/BS 5750. 


The paragraphs in normal print state Lloyd’s Registers inter- 
pretation and application to the work of Lloyd’s Register. 


1. BASIS OF REQUIREMENTS 


ie 


These requirements are based upon: 

1.1.1 ISO 9001/BS 5750 Part 1 

1.1.2 LACS Quality System Certification Scheme 
1.1.3 AQAP - 1 (Edition 3) (NATO/MOD Standard) 


1.1.4 BS 5882 (Nuclear Industry Standard) 

They are a reasonable interpretation of the requirements 
of these standards when applied to the work of LR. 

They compare with these standards as shown on the 
following pages. 

It is important to bear in mind that these requirements are 
applicable to LR’s operations. Care must be taken not to 
confuse these with clients or manufacturers’ operations. 
The product of LR’s services is essentially the advice LR 
provides in the form of a certificate or report. 

This advice ensues from the skill applied by the surveyor 
or specialist by understanding, analysis and judgement as 
a professional. To do this properly the surveyor or special- 
ist sometimes seeks the advice of his colleagues. It is the 
systematic management of these functions and _ their 
supporting services which is the object of the quality 
system. 


Comparison of ISO and Lloyd’s Register Requirements. 


ISO 9001 LR 
Requirement Requirement 
4.1 Management responsibility Section 3, 
4, & 23 
4.2 Quality system Section 5 
4.3 Contract review Section 6 
4.4 Design control Section 7 
4.5 Document control Section 9 
4.6 Purchasing Section 10 
4.7 Purchaser supplied product Section 12 
4.8 Product identification 
and traceability Section 13 
4.9 Process control Section 14 
4.10 Inspection and Testing Section 12 & 
15 
4.11 Inspection, Measuring 
and Test Equipment Section 16 
4.12 Inspection and Test Status Section 13 & 
17 
4.13 Control of Non-Conforming 
product (Certificates, 
reports etc.) Section 18 & 
22 
4.14 Corrective action Section 22 
4.15 Handling, storage, 
packaging and delivery Section 19 
4.16 Quality Records Section 20 
4.17 — Internal Quality Audits Section 21 
418 Training Section 24 
4.19 Servicing - 
4.20 Statistical Techniques Section 25 


Comparison of LACS and Lloyd’s Register Requirements 


IACS LR 

Requirement Requirement 

4. Management Responsibility Section 3 
and 4 

a. The Quality System Section 5 


6. Management Reviews 


of the Quality System Section 23 


i: Organisation and 
Responsibilities 

8. Classification Rules 
and Regulations 

5 Work Control 

10. Reviews of Requests for 
the Society’s Services 

sy Document Control 

12. Job Identification, Status 
and Traceability 

ik Inspection, Measuring 
and Test Equipment 

14. Sub-contracting 


iS, Records 

16. Training and Recruitment 

bee Internal Quality System Audits 
18. Non-conformities and 


Corrective Actions 
Ihe Statistical Techniques 
20. Handling and Protection 
of Documents 


Section 4 


Section 8 
Section 14 


Section 6 
Section 9 


Section 13 


Section 16 
Section 11 
Section 20 
Section 24 
Section 21 


Section 22 
Section 25 


Section 19 


Comparison of AQAP-1Land Lloyd’s Register Requirements 


AQAP-I 

Requirement 

Chapter 2 Paragraph Requirements 

201 General 

202 Organisation 

203 Quality Control System Review 
204 ~~ Planning 

205 Quality Control Documentation 
205(a) Procedures 


205(b) Work Instructions 
205(c) Inspection and Test Instructions 
205(d) Records 


206 Corrective Action 
207. ~~‘ Design and Development 
Control 
208 Documentation Control 
and Change Control 
208(a) Documentation Control 
208(b) Change Control 
209 ~~ Control of Inspection, 
Measuring and Test Equipment 
210 Control of Contractor Purchased 
Material and Services 
210(a) Purchasing 
210(b) Purchasing Data 
210(c) Receiving Inspection 
210(d) Verification of Purchased 
Material 
211 Manufacturing Control 
211(a) General 
211(b) Control of Special Processes 
212 Purchaser Supplied Material 
213 In-process and Final 
Inspection and Testing 
213(a) In-Process Inspection 
and Testing 
213(b) Final Inspection and Testing 
214 Sample Procedures 
215. ~~ Control of Non-Conforming 


Material 


LR 


Requirement 


Section 3 & 5 
Section 3, 4 
& 23 

Section 14, 
21 & 23 
Section 6 
Section 5 
Section 5 & 14 
Section 14 
Section 15 
Section 10 
Section 22 


Section 7 
Section 9 
Section 9 
Section 16 


Section 12 
Section 10 
Section 10 


Section 10 
Section 14 
& 15 
Section 14 
& 15 


Section 12 
Section 15 
Section 15 
Section 15 


Section 25 


Section 18 


216 
217 


Indication of Inspection Status 
Handling, Storage and Packing 


217(a) Materiel Handling 
217(b) Storage 
217(c) Packing 
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Accommodation and Assistance 


Section 13 
Section 19 
Section 19 
Section 19 
Section 19 
Section 26 


Comparison of BS 5882 and Lloyd's Register Requirements 


BS 5882 
Requirement 
4. Quality Assurance Programmes 
3 Organisation 
6. Design Control 
ip Procurement Document Control 
8. Instructions, Procedures 
and Drawings 
9. Document Control 
10. Control of Purchased 
Items and Services 
rT: Identification and 
Control of Items 
12; Process Control 
iS: Inspection and Surveillance 
14. Test Control 
ED; Control of Measuring 
and Test Equipment 
16. Handling, Storage and Shipping 
lige Inspection, Test and 
Operating Status 
18. Non-Conforming Items 
19. Corrective Action 
20. Records 
pale Audits 


2. DEFINITIONS 


For the purposes of this International Standard, the definitions 
given in ISO 8402 apply. 

NOTE - For the purposes of this International Standard, 
the term “product” is also used to denote “service”, as appro- 


priate. 


LR 
Requirement 


Section 5 & 23 
Section 4 & 24 
Section 7 
Section 10 & 
14 


Section 14 
Section 9 


Section 10 & 
12 


Section 13 & 
14 

Section 14 
Section 13, 
14&15 
Section 15 & 
7 


Section 16 
Section 19 


Section 17 
Section 18 
Section 22 
Section 20 
Section 21 


2.1 Terms used in these requirements are defined as follows: 


Fs be 


Specific to LR 
document 
and discs. 


Paper, microfiche, magnetic tapes 


head 


location 


materiel 


non- 
compliance 


The person responsible for super- 
vising the operations of an office, 
department, division, or region. 


Any section, office, department, 
division or region in LR whose 
work has a direct bearing on the 
quality of LR products. 

The necessary materials, supplies 
etc. (Materiel is referred to in 
AOAP-1.) 

A certificate, report, paper, 
software, lecture, talk, practice or 


th 


i) 


procedure 


practice 


LR product 


Purchased 
Product 


Quality- 
Related 


OAR 


procedure which includes an error 
Or omission or does not satisfy 
specified requirements. 


A document which prescribes a 
course of action. 


Actual doing of work. 


A certificate, report, publication, 
paper, software, lecture or talk, 
which incorporates the profes- 
sional skill of LR Staff. 
Anitem(s) or service purchased by 
LR or any third party. 

A term applying to any activity or 
document which controls or 


contributes to the quality of LR 
products. 


Quality assurance representative. 


General (from ISO 8402) 


Quality 


Quality Policy 


Quality 
Management 


Quality 
Assurance 


Quality System 


Quality Plan 


Quality Audit 


Quality 
Surveillance 


The totality of features and char- 
acteristics of a product or service 
that bear on its ability to satisfy 
stated or implied needs. 


The overall quality intentions and 
direction of an organization as 
regards quality, as formally 
expressed by top management. 


That aspect of the overall manage- 
ment function that determines and 
implements the quality policy. 


All those planned and systematic 
actions necessary to provide 
adequate confidence that a product 
or service will satisfy given require- 
ments for quality quality control. 
The operational techniques and 
activities that are used to fulfil 
requirements for quality. 


The organisation __ structure, 
responsibilities, procedures, 
processes and resources for imple- 
menting quality management. 

A document setting out the 
specific quality practices, 
resources and sequence of activi- 


ties relevant to a_ particular 
product, service, contract or 
project. 


A systematic and independent 
examination to determine whether 


quality activities and related 
results comply with planned 
arrangements and whether the 


arrangements are implemented 
effectively and are suitable to 
achieve objectives. 


The continuing monitoring and 
verification of the status of proce- 
dures, methods, conditions, 
processes, products and services, 
and analysis of records in relation 
to stated reference to ensure that 


Quality 
System 
Review 


Specification 


specified requirements for quality 
are being met. 


A formal evaluation by top 
management of the status and 
adequacy of the quality system in 
relation to quality policy and new 
objective resulting from changing 
circumstances. 

The document that prescribes the 


requirements with which the prod- 
uct or service has to conform. 


3. MANAGEMENT RESPONSIBILITY 


Quality Policy 


The supplier's management shall define and document its policy 
objectives for, and commitment to, quality. The supplier shall 
ensure that this policy is understood, implemented and main- 
tained at all levels in the organisation. 


3.1 Quality Policy 
31a 


The Chairman of Lloyd’s Register shall define and 


document LR policy and objectives for, and 
commitment to, quality. 
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This shall include statements to the effect that: 


a) itis LR policy to establish, document and main- 
tain a quality system which complies with these 
requirements 

b) this policy shall be understood, implemented 
and maintained at all levels and locations in the 
organisation. 


3.2 Management Representative 


The supplier shall appoint a management representative who, 
irrespective of other responsibilities, shall have defined authority 
and responsibility for ensuring thatthe requirements of this inter- 
national Standard are implemented and maintained. 


S271 


The Chairman of Lloyd’s Register shall appoint a 


management representative who, irrespective of 
other responsibilities, shall have the defined 
authority, responsibility and organisational free- 
dom for assuring that these Quality System 
requirements are implemented and maintained 
throughout LR. However this does not supersede 
the line managers’ responsibility for the quality of 


our service. 


4. ORGANISATION AND RESPONSIBILITIES 


The responsibility , authority and the interrelation of all person- 
nel who manage, perform and verify work affecting quality shall 
be defined; particularly for personnel who need the organiza- 
tional freedom and authority to: 


(a) 

formity; 
(b) 
(c) 

nated channels; 
(d) 
(e) 


initiate action to prevent the occurrence of product noncon- 


identify and record any product quality problems; 
initiate, recommend or provide solutions through desig- 


verify the implementation of solutions; 
control further processing, delivery or installation or 


nonconforming product until the deficiency or unsatisfac- 
tory condition has been corrected. 


4.1 Inter-relationships 


The inter-relation of all personnel whose work affects, or could 
affect the quality of LR products shall be defined on organisa- 
tion charts as follows: 

4.1.1 Executive level — Charts to include Chairman, The 
Management Committee, The Quality Committee, 
The Deputies, The Regional Managers and the 
Division Managers, all by title. 

Region level—A chart for each region showing: 

(a) The region manager and relationship with the 
executive chart. 

(b) The principal office(s) in the region. 

(c) The local offices in the region. 

Division level—A chart for each Division showing: 

(a) The division head and relationship with the 
executive chart. 

(b) The departments and offices in the division. 

Department and office level-A chart for each 

department or office, including local offices, show- 

ing: 

(a) The head of the department or office and rela- 
tionship with the division or region chart. 

(b) The sections and staff within the department 
or office. 

Quality Management Structure—A chart showing 

the quality management structure. 

Each organisation chart shall be approved by the 

head of the location concerned and his supervisor. 


4.1.3 


4.2 Responsibilities 


The responsibilities of all personnel referenced in 4.1 shall be 
defined and documented. Responsibilities shall include those 
delegated to maintain continuity of control in the absence of 
supervisory personnel. 


4.3 Authorities 


The authorities of all personnel referenced in 4.1 shall be 
defined and documented. Authorities shall include those dele- 
gated to maintain continuity of control in the absence of 
supervisory personnel. 


4.4 Understanding 


All staff shall be familiar with: 

(i) the organisation chart pertaining to their location; 
(ii) their responsibilities; 

(iii) their authorities. 


5. THE QUALITY SYSTEM 


The supplier shall establish and maintain a documented quality 
system as ameans of ensuring that product conforms to specified 
requirements. This shall include: 

(a) the preparation of documented quality system procedures 
and instructions in accordance with the requirements of this 
International Standard; 

(b) the effective implementation of the documented quality 
system procedures and instructions. 


NOTE-Inmeeting specified requirements, timely consideration 

needs to be given to the following activities: 

(a) the preparation of quality plans and a quality manual in 
accordance with the specified requirements; 

(b) the identification and acquisition of any controls, processes, 
inspection equipment, fixtures, total production resources 
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and skills that may bee needed to achieve the required 
quality; 

the updating, as necessary, of quality control, inspection 
and testing techniques, including the development of new 
instrumentation; 

the identification of any measurement requirement involv- 
ing capability that exceeds the known state of the art in 
sufficient time for the needed capability to be developed; 
the clarification of standards of acceptability for all features 
and requirements, including those which contain a subjec- 
tive element; 

the compatibility of the design, the production process, 
installation, inspection and test procedures and the appli- 
cable documentation; 

the identification and preparation of quality records (see 
4.16). 


(c) 


(d) 


(e) 


(—) 


(g) 


5.1 Establishment 


5.1.1 A quality system, complying with these require- 
ments shall be established, documented and 
maintained at all locations within LR. 

The quality system shall be applied over each func- 
tion which affects, or could affect, the quality of LR 


product. 


5.2 Documentation 


5.2.1 The quality system shall be documented in a hier- 
archical structure. 

The principal quality system documents shall be 
titled and numbered in one system. 

Each document in LR which affects the quality of 
LR product shall be included in the quality system 


documentation either directly or by cross reference. 


Dede 


3:23 


5.3 Scope 


5.3.1 the scope of services provided by LR shall be 


defined in the Corporate Quality Manual. 


6. CONTRACT REVIEW 


The supplier shall establish and maintain procedures for 
contract review and for the co-ordination of these activities. 
Each contract shall be reviewed by the supplier to ensure that: 
the requirements are adequately defined and documented; 
any requirements differing from those in the tender are 
resolved; 
the supplier has the capability to meet contractual require- 
ments. 
Records of such contract reviews shall be maintained (see 
4.16) 


(a) 
(b) 


(c) 


NOTE - The contract review activities, interfaces and commu- 
nication within the supplier's organization should be 
coordinated with the purchaser's organization, as appropriate. 


6.1 At each location, procedures shall exist for reviewing 

instructions received from clients, or from elsewhere in 

LR, for fee earning work. The procedures shall address 

review of contract requirements at pre-contract and subse- 

quent Stages, to ensure the following: 

6.1.1 The requirements are adequately defined, docu- 
mented and responsibilities assigned. 
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Any requirements differing from those in a tender 
are resolved. 


6.1.3. The location has the necessary capability and 
resources to meet the requirements. 

6.1.4 There is adequate and documented control of 
design/design appraisal and development. 

6.1.5 The identification of inspection and test stages for 
components and main assemblies. 

6.1.6 The identification of all in process and final inspec- 
tion and testing necessary to establish conformance 
to contractual requirements. 

6.1.7 The establishment of requirements for skill, selec- 
tion and training of personnel to perform any 
activities identified. 

6.1.8 The identification of special requirements for 
purchased material or services. 

6.1.9 The establishment of requirements for on site 
receipt installation and putting into operation. 

6.1.10 The establishment of quality control requirements 
which shall include involvement of those responsi- 
ble for assuring quality. 

6.1.11 The assessment of work in progress and work flow. 

6.1.12 The responsibility for outstanding actions (includ- 
ing corrective) is clearly defined to ensure timely 
resolvement. 

6.1.13. The timely notification of major non-compliances 
to the clients QAR where required by controlling 
documents. 

6.1.14 Any other matters having a bearing upon quality 


of the work are considered. 


Wherever practicable a check list shall be utilised and upon 
completion of the review, the check list shall be endorsed 
by the reviewer. 


6.3 Records of all reviews shall be maintained. 


7. DESIGN CONTROL 


The supplier shall establish and maintain procedures to control 
and verify the design of the product in order to ensure that the 
specified requirements are met. 


7.1 Design/Design Appraisal 


At each location within LR concerned with design or design 
appraisal, procedures shall be established to control and verify 
the design or design appraisal process in order to ensure that 
the specified requirements are met. 


7.2 Design and Development planning 


The supplier shall draw up plans that identify the responsibility 
for each design and development activity. The plans shall 
describe or reference these activities and shall be updated as the 
design evolves. 

Plans/procedures shall be drawn up appropriate to the 
complexity of the work that identify the responsibility for each 
design or design appraisal and development activity. The plans 
shall describe or reference these activities and shall be updated 
as the design evolves. 


7.3 Activity Assignment 


The design and verification activities shall be planned and 
assigned to qualified personnel equipped with adequate 
resources. 


The design and design appraisal and verification activities 
shall be planned and assigned to qualified personnel equipped 
with adequate resources. 


7.4 Organisational and Technical Interfaces 


Organisational and technical interfaces between different groups 
shall be identified and the necessary information documented, 
transmitted and regularly reviewed. 

Organisational and technical interfaces between different 
divisions, departments or offices shall be identified and the 
necessary information documented, transmitted and reviewed. 


7.5 Design/Design Appraisal Input 


Design input requirements relating to the product shall be iden- 
tified, documented and their selection reviewed by the supplier 


for adequacy. 


Incomplete, ambiguous or conflicting requirements shall be 
resolved with those responsible for drawing up these require- 
ments. 


7.5.1 Design/design appraisal input requirements relat- 
ing to the product shall be identified, documented 
and their selection reviewed by the controlling divi- 
sion, department or office for adequacy. 

7.5.2. Incomplete, ambiguous or conflicting require- 


ments shall be resolved by those responsible for 
drawing up these requirements. 


7.6 Design/Design Appraisal Output 


Design output shall be documented and expressed in terms of 
requirements, calculations and analyses. 
Design output shall: 
meet the design input requirements; 
contain or reference acceptance criteria; 
conform to appropriate regulatory requirements whether 
or not these have been stated in the input information; 
identify those characteristics of the design that are crucial 
to the safe and proper functioning of the product. 
Design/design appraisal output shall be documented and 
expressed in terms of requirements, calculations and analysis 
and shall: 


(a) 
(b) 
(c) 


(d) 


7.6.1. Meet the design/design appraisal input require- 
ments. 

7.6.2 Contain or reference acceptance criteria. 

7.6.3 Conform to appropriate regulatory requirements 
whether or not these have been stated in the input 
information. 

7.6.4 Identify those characteristics of the design that are 


crucial to the safe and proper functioning of the 
product. 


7.7 Design/Design Appraisal Verification 


The supplier shall plan, establish, document and assign to 
competent personnel functions for verifying the design. 

Design verification shall establish that design output meets 
the design input requirement (see 4.4.4) by means of design 
control measures such as: 

(a) holding and recording design reviews (see 4.16); 
(b) undertaking qualification tests and demonstrations; 
(c) carrying out alternative calculations; 
(d) comparing the new design with a similar proven design, if 
available. 
7.7.1 Eachareaconcerned with design or design appraisal 
shall plan, establish, document and assign to compe- 
tent personnel functions for verifying and design. 


7.7.2 Design/design appraisal verification shall establish 
that design, design appraisal output meets the 
design input requirements by means of design 
control measures such as 
(a) Holding and recording design reviews. 

(b) Undertaking qualification tests and demon- 
strations. 
(c) Carrying out alternative calculations. 
(d) Comparing the new design with a similar 
proven design. 


7.8 Design/Design Appraisal Changes/Concessions 


The supplier shall establish and maintain procedures for the 
identification, documentation and appropriate review and 
approval of all changes and modifications. 

Each location shall establish and maintain procedures for 
the identification, documentation and appropriate review and 
approval of all changes and modifications including those aris- 
ing from concessions. 


8. CONTROL OF RULES AND REGULATIONS 


8.1 Classification Rules and Regulations 


Procedures shall be established and maintained for the formu- 

lation, approval and continuous update of the LR’s rules and 

regulations for the classification of ships and offshore installa- 

tions. Procedures shall incorporate the following: 
8.1.1 Planning 

Each activity involved in the development of the 

rules and regulations shall be identified and 

planned. 

Organisational and Technical Interfaces 

Organisational and technical interfaces between 

different groups, both inside and outside the organ- 

isation, shall be identified and information crossing 

the interfaces shall be documented, transmitted and 

regularly reviewed. 

Inputs 

In developing its rules and regulations LR shall 

ensure that the necessary information is available 

to the groups concerned and that the following are 

taken into account as appropriate: 

(a) thetechnical,regulatory and statutory require- 
ments which have to be satisfied 

(b) in-service experience with ships and offshore 
installations. 

Outputs 

(a) LR shall submit its proposed rules and amend- 
ments to existing rules to organisations 
representing material manufacturers, 
builders, owners, professional institutions and 
authorities, as appropriate, for review and 
comment. 

(b) The submissions and comments shall be docu- 

mented. 

Comments received shall be suitably taken 

into account by LR in finalising its rules and 

this shall be documented. 


8.1.2 


(c) 
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9. DOCUMENT CONTROL 


The supplier shall establish and maintain procedures to control 
all documents and data that relate to the requirements of this 
International Standard. These documents shall be reviewed and 
approved for adequacy by authorized personnel prior to issue. 
This control shall ensure that: 

(a) the pertinent issues of appropriate documents are available 
at all locations where operations essential to the effective 
functioning of the quality system are performed; 

obsolete documents are promptly removed from all points 
of issue or use. 


(b) 


Document changes/modifications 

Changes to documents shall be reviewed and approved by the 
same functions/organizations that performed the original review 
and approval unless specifically designated otherwise. The 
designated organizations shall have access to pertinent back- 
ground information upon which to base their review and 
approval. 

Where practicable, the nature of the change shall be identified 
in the document or the appropriate attachments. 

A master list or equivalent document control procedure shall 
be established to identify the current revision of documents in 
order to preclude the use of nonapplicable documents. 

Documents shall be re-issued after a practical number of 
changes have been made. 

NB Whilst these requirements are written in terms of paper 
documents, the definition of ‘document’ stated in Clause 2.1.1 
includes storage facilities such as micro-fiche, magnetic tapes 
and discs. The requirements are applicable to those items also. 


9.1 At each location procedures and practices shall be estab- 
lished and maintained to control documents that relate to 
the quality of LR product. 

9.1.1 Two levels of control shall apply. 

(a) Primary documents These are documents 
which state technical requirements with which 
there must be compliance. Their application is 
generally widespread and of long term inter- 
est. (Examples are: Rules, Standards, 
Specifications, Codes of Practice, Manuals, 
Contract Guidance Notes, Drawings, Plans 
and Quality Plans). 

The controls in 9.2 and 9.3 shall apply. 

Secondary documents These are documents 

other than the Primary documents above. 

(Examples are: Certificates, Reports, letters, 

memoranda, telexes and faxes). The controls 

in 9.4 and 9.5 shall apply. 

For primary documents produced on a continuing 

basis e.g. pro-forma orders, contract guidance 

notes, there shall be written procedures to control 
their preparation. 


(b) 
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For primary documents produced within the location the 
following controls shall apply: * 


9.2.1 The document shall be titled, bear a number and a 
revision status and date. 

9.2.2 The document shall be reviewed for adequacy by 
someone other than the originator. 

9.2.3. The document shall be approved by an authorised 
person, not the originator, and signed. 

9.2.4 Acontrolled distribution shall be maintained which 


ensures that pertinent issues of the documents are 
available at the locations required. 


9.3 


So 
i) 
A 


Documents shall be formally distributed and 
sighted by those persons who ‘need to know’. 
Records shall be maintained which shall provide 
evidence of transmission, receipt and/or sighting. 
Changes to documents shall be reviewed, and 
approved by the same procedure as was applied to 
the original document. 
Changed documents shall be distributed to the loca- 
tions required with notices of the changes. 
The change notices shall state the nature of the 
change and the actions which must be taken by the 
recipient. 
Receipts shall be required for documents or 
changes, the non-delivery of which would be unde- 
tected and would result in serious failure. 
Master lists shall be established and maintained at 
each location to identify the current revision of 
documents in order to preclude the use of non- 
applicable documents. 
Copies of quality-related documents which are not 
within the control system shall be stamped to the 
effect that they are not controlled. 
Obsolete documents shall be removed promptly 
from all points of issue or use. They shall be 
destroyed or marked to the effect that they are 
obsolete and archived or returned to the sender. 
Each controlled document, which is not specific to 
one contract, shall be reviewed once per year to 
verify continuing accuracy and applicability. 
The dates of the reviews shall be recorded. 
* Other controls apply to 

the ‘Rules and Regulations’ 

the ‘Codes of Practice’ 


For primary documents received from elsewhere in LR or 
from outside LR: 


9.3.1 
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The documents shall be reviewed upon receipt for 
adequacy. 

Paragraph 9.2.10 applies. 

Paragraph 9.2.11 applies. 

Paragraph 9.2.12 applies. 

If the documents received are to be re-distributed, 
as in the case of a Surveyor resident in a manufac- 
turing works, paragraphs 9.2.4, 9.2.5, 9.2.7 to 9.2.9 
shall also apply. 


For secondary documents produced within the location the 
following shall apply: 


9.4.1 


9.4.2 


9.4.3 


9.4.4 


9.4.5 


Each original document; 

(a) shall be on the approved format for the subject. 

(b) shall clearly identify the intended recipient(s). 

(c) shall bear a subject title, reference, client’s 
reference and date. 

(d) shall be signed by an authorised person. 

Copies of each document shall be distributed on a 

need-to-know basis. 

Where a reply is required, a procedure shall be 

established to expedite the reply. 

Changes to secondary documents are not permit- 

ted. A change in information shall be notified by a 

superseding document. 

Filing arrangements shall ensure that documents 

are held secure in their files. 


For secondary documents received from elsewhere in LR 
or from outside LR: 


9/5.1 


Each document 
(a) shall be registered upon receipt. 


(b) shall be examined and acted upon by a desig- 
nated person. 

Where the document is to be re-distributed (eg. 

within an office) controls shall ensure that the docu- 

ment has been re-distributed and that the intended 

recipient (s) has seen it. 

Where a reply is required a procedure shall be 

established to expedite the reply. 

Controls shall be established to verify that appro- 

priate actions have been taken before the document 

is filed. 

Filing arrangements shall ensure that documents 

are held secure in their files. 

9.6 Verbal communications of quality related information 

9.6.1 When quality related information is passed verbally 
it shall be confirmed in a document, (eg.. letter, 
memo, fax, minutes of meeting, report) promptly. 


10. PURCHASING 


The supplier shall ensure that purchased product conforms to 
specified requirements. 
10.1 LR shall ensure that purchased product conforms to spec- 
ified requirements. 
10.2 It should be noted that LR may undertake the role of 
purchaser, depending upon the requirements of the 
contract. 
10.3. Purchasing documentation 
Purchasing documents shall contain data clearly describing 
the product ordered, including, where applicable, 
(a) _ the type, class, style, grade or other precise identifi- 
cation; 
the title or other positive identification, and applica- 
ble issue of specifications, drawings, process 
requirements, inspection instructions and other rele- 
vant technical data, including requirements for 
approval or qualification of product, procedures, 
process equipment and personnel; 

the title, number and issue of the quality system 

International Standard to be applied to the product. 

The supplier shall review and approve purchasing 

documents for adequacy or specified requirements 

prior to release. 

Purchasing documents shall contain data clearly 

describing the product ordered including where 

applicable 

(a) The type, class, style, grade or other precise 
identification. 

(b) The title or other positive identification and 
applicable issue of specifications, drawings, 
process requirements, inspection instructions 
and other relevant technical data including 
requirement for approval or qualification of 
product, procedures, process equipment and 
personnel.. 

(c) The title, number and issue of the quality 
system international standard to be applied to 
the product. 

Purchasing documents shall be reviewed for 

adequacy of specified requirements and approved 

prior to release. 


(b) 


(c) 


10.3.2 


10.4 Verification of purchased product 

Where specified in the contract, the purchaser or his repre- 
sentative shall be afforded the right to verify at source or 
upon receipt that purchased product conforms to specified 
requirements. Verification by the purchaser shall not 
absolve the supplier of the responsibility to provide accept- 
able product nor shall it preclude subsequent rejection. 

When the purchaser or his representative elects to carry out 

verification at the sub-contractor’s plant, such verification 

shall not be used by the supplier as evidence of effect control 
of quality by the sub-contractor. 

10.4.1 Where specified in the contract of sub-contract the 
purchaser or their representatives shall be afforded 
the right to verify at source or upon receipt that 
purchased product conforms to specified require- 
ments. verification by the purchaser shall not 
absolve the supplier of the responsibility to provide 
acceptable product nor shall it preclude subsequent 
rejection. 

10.4.2 When a client or his representative elects to carry 
out verification at a subcontractors plant such veri- 
fication shall not be used by LR as effective control 
of quality by the subcontractors. 


11. SUB-CONTRACTING 


The supplier shall select sub-contractors on the basis of their 
ability to meet sub-contract requirements, including quality 
requirements. The supplier shall establish and maintain records 
of acceptable sub-contractors (see 4.16). 

The selection of sub-contractors, and the type and extent of 
control exercised by the supplier, shall be dependent upon the 
type of product and, where appropriate, on records of sub- 
contractors’ previously demonstrated capability and 
performance. 

The supplier shall ensure that quality system controls are 
effective. 


11.1 Procedures shall be established at each location to select 
and control the use of sub-contractors engaged in quality- 
related activities. 


11.2 The procedures shall ensure that: 
11.2.1 the capability of the sub-contractor is known before 
engagement either 
(a) by demonstrated capability in providing a 
service to LR previously 
or 
(b) by assessment by LR staff. 
Records shall be kept of the justification. 
11.2.2 sub-contractors, and the extent of their employ, are 
approved by the appropriate Divisional or 
Regional Manager or their delegated nominee. 

.2.3 a list of approved sub-contractors is maintained. 

4 the sub-contractor is advised in writing of the 
service required. The advice shall be specific and 
shall include duties, responsibilities and the stan- 
dards to be applied. 

11.2.5 effective controls are maintained over the sub- 

contractor whilst providing the service. 


NB - Non-exclusive Surveyors, Acting Surveyors and Agents 
shall, in the quality system, be regarded as ‘sub-contractors’ and 
the foregoing will apply. 


12. PURCHASER SUPPLIED PRODUCT 


The supplier shall establish and maintain procedures for verifi- 
cation, storage and maintenance of purchaser supplied product 
provided for incorporation into the supplies. Any such product 
that is lost, damaged or is otherwise unsuitable for use shall be 
recorded and reported to the purchaser (see 4.16). 


NOTE - Verification by the supplier does not absolve the 
purchaser of the responsibility to provide acceptable product. 


12.1 Procedures shall be established and maintained for verifi- 
cation, storage and maintenance or purchaser supplied 
product provided for incorporation into the supplies. 


12.2 Any such product that is lost, damaged or is otherwise 
unsuitable for use shall be recorded and reported to the 
purchaser. 


13. JOB/PRODUCT IDENTIFICATION, 
STATUS AND TRACEABILITY 


Where appropriate, the supplier shall establish and maintain 
procedures for identifying the product and applicable drawings, 
specifications or other documents, during all stages of produc- 
tion, delivery and installation. 

Where, and to the extent that, traceability is a specified 
requirement, individual product or batches shall have a unique 
identification. This identification shall be recorded (see 4.16). 


13.1 Procedures shall be established and maintained at each 
location for identifying each job upon receipt or initiation 
and maintaining this identification, either directly or by 
cross-reference, on all documents and records relating to 
the job. 


13.2 Procedures shall also provide for periodically examining 
and recording the status of each job at appropriate stages. 


13.3 All job-related documents and records shall be traceable 
from: 
(i) the clients instruction. 
(ii) the certificate or report number. 
whichever is quoted. 


14. WORK CONTROL 


The supplier shall identify and plan the production and, where 
applicable, installation processes which directly affect quality 
and shall ensure that these processes are carried out under 
controlled conditions. controlled conditions shall include the 


following: 


a) documented work instructions defining the manner of 
production and installation, where the absence of such 
instructions would adversely affect quality, use of suitable 
production and installation equipment, suitable working 
environment, compliance with reference standards/codes 
and quality plans; 

b) monitoring and control of suitable process and product 
characteristics during production and installation; 

c) the approval of processes and equipment, as appropriate; 

d) criteria for workmanship which shall be stipulated, to the 
greatest practicable extent, in written standards or by means 
of representative samples. 

These are processes, the results of which cannot be fully veri- 
fied by subsequent inspection and testing of the product and 


where, for example processing deficiencies may become appar- 
ent only after the product is in use. Accordingly, continuous 
monitoring and/or compliance with documented procedures is 
required to ensure that the specified requirements are met. These 
processes shall be qualified and shall also comply with the 
requirements of 4.9.1. 

Records shall be maintained for qualified processes, equip- 
ment and personnel, as appropriate. 


14.1 All work shall be carried out under controlled conditions. 


14.2 Controlled conditions include: 

14.2.1 Documented procedures; which shall prescribe a 
course of action (which may involve more than one 
person or one location). 

14.2.2 Documented Work instructions, (general); which 
shall define the manner in which work shall be 
performed, where the absence of such instructions 
would adversely affect quality. 


Note — Whilst a procedure must exist for each course of action, 
it is a matter of judgement as to whether or not the procedure 
shall be supplemented by a documented work instruction to a 
individual person, the test being how effectively the work would 
be done in the absence of the person normally doing the work. 


14.2.3 Documented Work instructions (job specific); 
which shall define the job requirements. 

14.2.4 Project Management Procedures (Job Specific) 
which shall identify and plan the project services to 
be provided, where standard work procedures and 
instruction are insufficient for their control. 
Consideration shall be given to: 

(a) Prescribing, implementing and updating qual- 
ity plans 
(b) Responsibilities including for quality assur- 
ance liaison and reporting to client 
) Resourcing 

(d) Methods 
(e) Control of concessions 
(f) Reviews 
(g) Verification 

14.2.5 Suitable environment in way of lighting, space, 
furniture, temperature and ventilation. 

14.2.6 Adequate facilities in way of equipment, computer 
services, control of programmes, control of stan- 
dards, codes, specifications, statutory 
requirements, LR rules, regulations and manuals. 

14.2.7 Qualified personnel on the basis of designation, 
education, training and experience. 

14.2.8 Supervision which shall be at a level appropriate to 
the work to be done, the nature of the work, the 
number of personnel and the designations and 
experience of the personnel. Continuity of control 
shall be maintained in the absence of supervisory 
personnel. 

14.2.9 Document Monitoring which shall include regular 
examinations by the head of the location (or some- 
one assigned by him) of samples of each type of 
document produced within the location. 
The examinations shall verify the accuracy and 
completeness of the documents. The samples exam- 
ined shall be endorsed and records shall be kept. 

14.2.10System Monitoring which shall include regular 
examinations by the head of the location (or some- 
one assigned by him) of samples of job files, control 
records and computerised records. 


These examinations shall verify that the systems are 
being maintained correctly. Records of the exami- 
nations made shall be kept. 

14.2.11 Activity monitoring (field Surveyors), which shall 
include regular witness by the head of the location 
(or someone assigned by him) of the practices of 
field Surveyors performing their duties. Records of 
the activities witnessed shall be kept. 


15. INSPECTION AND TESTING 


The supplier shall: 

(a) inspect, test and identify product as required by the quality 
plan or documented procedures; 

(b) establish product conformance to specified requirements by 
use of process monitoring and control methods; 

(c) hold product until the required inspection and tests have 
been completed or necessary reports have been received and 
verified except when product is released under positive 
recall procedures (see 4.10.1). Release under positive recall 
procedures shall not preclude the activities outlined in 
4.10.2a); 

(d) identify nonconforming product. 


15.1 In Process Inspection and Test 


LR shall 

15.1.1 Inspect, test and identify product as required by the 
quality plan or documented procedures. 

15.1.2 Establish product conformance to specified 
requirements by use of process monitoring and 
control methods. 

15.1.3 Hold product until the required inspection and tests 
have been completed or necessary reports have 
been received and verified except when product is 
released under positive recall procedures (see 
15.5.2). Release under positive recall procedures 
does not preclude the activities outlined in 15.1.1 
above. 

15.1.4 Identify non-conforming product. 


15.2 Final Inspection and Testing 


The quality plan or documented procedures for final inspection 
and testing shall require that all specified inspection and tests, 
including those specified either on receipt of product or in 
process, have been carried out and that the data meets specified 
requirements. 

The supplier shall carry cut all final inspection and testing in 
accordance with the quality plan or documented procedures to 
complete the evidence of conformance of the finished product 
to the specified requirements. 

No product shall be despatched until all the activities speci- 


fied in the quality plan or documented procedures have been 


satisfactorily completed and the associated data and documen- 
tation ts available. 

15.2.1 The quality plan or documented procedures for 
final inspection and testing shall require that all 
specified inspections and tests including those spec- 
ified either on receipt of product or in process have 
been carried out and that the data meets specified 
requirements. 

15.2.2 Final inspection and testing shall be carried out in 
accordance with the quality plan or documented 
procedures to complete the evidence of confor- 
mance of the product to the specified requirements. 


15.2.3 No product shall be dispatched until all the activi- 
ties specified in the quality plan or documented 
procedures have been satisfactorily completed and 
the associated data and documentation is available 
and authorised. 


15.3 Reporting to Client’s QAR 


Any unusual difficulties found during inspection and testing 
shall be reported to the client’s QAR as required by the contract. 


15.4 Inspection and Test Records 


The supplier shall establish and maintain records which give 
evidence that the product has passed inspection and/or test with 
defined acceptance criteria (see 4.16). 

Records shall be established and maintained which give 
evidence that the product has passed inspection and/or test with 
defined acceptance criteria. 


15.5 Receiving Inspection and Test 


The supplier shall ensure that the incoming product is not used 
or processed (except in the circumstances described in 4.10.1.2) 
until it has been inspected or otherwise verified as conforming 
to specified requirements. Verification shall be in accordance 
with the quality plan or documented procedures. 

Where incoming product is released for urgent production 
purposes, it shall be positively identified and recorded (see 4.16) 
in order to permit immediate recall and replacement in the event 
of nonconformance to specified requirements. 


NOTE - In determining the amount and nature of receiving 
inspection, consideration should be given to the control exer- 
cised at source and documented evidence of quality 
conformance provided. 


15.5.1 Where LR acts in the role of purchaser procedures 
shall be established and maintained to ensure that 
the incoming product is not used or processed until 
it has been inspected or otherwise verified as 
conforming to specified requirements. Verification 
shall be in accordance with a quality plan or docu- 
mented procedures. 

Where incoming product is released for urgent 
purposes it shall be positively identified and 
recorded in order to permit immediate recall and 
replacement in the event of non-conformance to 
specified requirements. 
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16. INSPECTION MEASURING AND TEST 
EQUIPMENT 


The supplier shall control, calibrate and maintain inspection, 
measuring and test equipment, whether owned by the supplier, 
onloan, or provided by the purchaser, to demonstrate the confor- 
mance of product to the specified requirements. Equipment shall 
be used inamanner which ensures that measurement uncertainty 
is known and is consistent with the required measurement capa- 
bility. 
The supplier shall: 

a) Identify the measurements to be made, the accuracy 
required and select the appropriate inspection, measuring 
and test equipment; 

b) identify, calibrate and adjust all inspection, measuring and 
test equipment and devices that can affect product quality 
at prescribed intervals, or prior to use, against certified 


equipment having a known valid relationship to nationally 
recognized standards - where no such standards exist, the 
basis used for calibration shall be documented; 

c) establish, document and maintain calibration procedures, 
including details of equipment type, identification number, 
location, frequency of checks, check method, acceptance crite- 
ria and the action to be taken when results are unsatisfactory; 

d) ensure that the inspection, measuring and test equipment is 
capable of the accuracy and precision necessary; 

e) identify inspection, measuring and test equipment with a 
suitable indicator or approved identification record to show 
the calibration status; 

f) — maintain calibration records for inspection, measuring and 
test equipment (see 4.16); 

g) assess and document the validity of previous inspection and 
test results when inspection, measuring and test equipment 
is found to be out of calibration; 

h) ensure that the environmental conditions are suitable for 
the calibrations, inspections, measurements and tests being 
carried out; 

i) — ensure thatthe handling, preservation and storage of inspec- 
tion, measuring and test equipment is such that the accuracy 
and fitness for use is maintained; 

J) — safeguard inspection, measuring and test facilities, includ- 
ing both test hardware and test software, from adjustments 
which would invalidate the calibration setting. 

Where test hardware (e.g. jigs, fixtures, templates, patterns) 
or test software is used as suitable forms of inspection, they shall 
be checked to proved that they are capable of verifying the 
acceptability of product prior to release for use during produc- 
tion and installation and shall be rechecked at prescribed 
intervals. The supplier shall establish the extent and frequency 
of such checks and shall maintain records as evidence of control 
(see 4.16). Measurement design data shall be made available, 
when required by the purchaser or his representative, for veri- 
fication that it is functionally adequate. 


16.1 Inspection, measuring and test equipment which is not 
owned by LR, but information therefrom is used by LR to 
substantiate and LR product, shall be identified and cali- 
brated against certified equipment having a known valid 
relationship to nationally recognised standards. 


16.2 Inspection, measuring and test equipment owned by LR and 
used to substantiate an LR product shall be controlled, cali- 
brated and maintained. Equipment shall be used in a manner 
which ensures that measurement uncertainty is known and 
is consistent with the required measurement capability. 
The following requirements (taken from ISO 9001, 
C1.4.11) shall be satisfied: 

(i) identify the measurements to be made, the accuracy 
required and select the appropriate inspection, 
measuring and test equipment; 
identify, calibrate and adjust all inspection, measur- 
ing and test equipment and devices that can affect 
product quality at prescribed intervals, to prior to 
use, against certified equipment having a known 
valid relationship to nationally recognized stan- 
dards - where no such standards exist, the basis used 
for calibration shall be documented; 
establish, document and maintain calibration 
procedures, including details of equipment type, 
identification number, location, frequency of 
checks, check method, acceptance criteria and the 
action to be taken when results are unsatisfactory: 
ensure that the inspection, measuring and test 
equipment is capable of the accuracy and precision 
necessary; 


(ii) 


(iii) 


(iv) 


identify inspection, measuring and test equipment 
with a suitable indicator or approved identification 
record to show the calibration status; 
maintain calibration records for 
measuring and test equipment; 
assess and document the validity of previous inspec- 
tion and test results when inspection, measuring 
and test equipment is found to be out of calibration; 
ensure that the environmental conditions are suit- 
able for the calibrations, inspections, measurements 
and tests being carried out; 

ensure that the handling, preservation and storage 
of inspection, measuring and test equipment is such 
that the accuracy and fitness for use is maintained; 
safeguard inspection, measuring and test facilities, 
including both test hardware and software, from 
adjustments which would invalidate the calibration 
setting. 


(v) 


inspection, 


(vi) 


(vii) 


(vill) 


(ix) 


(x) 


17. INSPECTION AND TEST STATUS 


The inspection and test status of product shall be identified by 
using markings, authorized stamps, tags, labels, routing cards, 
inspection records, test software, physical location or other suit- 
able means, which indicate’ the conformance or 
nonconformance of product with regard to inspection and tests 
performed. The identification of inspection and test status shall 
be maintained, as necessary, throughout production and instal- 
lation of the product to ensure that only product that has passed 
the required inspections and tests is despatched, used or installed. 

Records shall identify the inspection authority responsible for 
the release of conforming product. 


17.1 The inspection and test status of product shall be identified 
by using markings, authorised stamps, tags, labels, routing 
cards, inspection records, test software, physical location 
or other suitable means which indicate the conformance 
or non-conformance of product with regard to inspection 
or tests performed. 


17.2 The identification of inspection and test status shall be 
maintained, as necessary, throughout production and 
installation of the product to ensure that only product that 
has passed the required inspections and tests is dispatched, 
used or installed. 


17.3 Records shall identify the inspection authority responsible 
for the release of conforming product. 


18. CONTROL OF NON-CONFORMING 
PURCHASED PRODUCT 


The supplier shall establish and maintain procedures to ensure 
that product that does not conform to specified requirements is 
prevented from inadvertent use or installation. Control shall 
provide for identification, documentation, evaluation, segrega- 
tion (when practical), disposition of nonconforming product 
and for notification to the functions concerned. 

The responsibility for review and authority for the disposition 
of nonconforming product shall be defined. 

Nonconforming product shall be reviewed in accordance 
with documented procedures. It may be: 
a) reworked to meet the specified requirements, or 
b) accepted with or without repair by concession, or 


c) re-graded for alternative applications, or 
d) rejected or scrapped. 

Where required by the contract, the proposed use or repair 
of product [see 4.14.1b)] which does not conform to specified 
requirements shall be reported for concession to the purchaser 
or his representative. The description of nonconformity that has 
been accepted, and of repairs, shall be recorded to denote the 
actual condition (see 4.16). 

Repaired and reworked product shall be re-inspected in 
accordance with documented procedures. 


18.1 It should be noted that LR may undertake the role of 
purchaser depending upon the requirements of the contract. 


18.2 Procedures for non-conformity review and disposition 
shall be established and maintained for purchased product. 


18.3 The responsibility for review and authority for the dispo- 
sition of nonconforming product shall be defined, 
documented and be acceptable to the ‘purchaser’s QAR’. 


18.4 Non-conforming product shall be reviewed in accordance 
with documented procedures. It may be: 
18.4.1 Reworked to meet the specific requirement or 
18.4.2 Accepted with or without repair by concessions or 
18.4.3 Regarded for alternative application or 
18.4.4 Rejected or scrapped. 


18.5 The proposed use of repair of product which does not 
conform to specific requirements shall be reported for 
concession to the ‘purchaser’s QAR’. The description of 
non-conformity that has been accepted, and of repairs, 
shall be recorded to denote the actual condition. 


18.6 Repaired and reworked product shall be reinspected in 
accordance with documented procedures and records 
maintained. 


19. HANDLING, STORAGE, PACKING AND 
DELIVERY 


The supplier shall provide methods and means of handling that 
prevent damage or deterioration. 

The supplier shall provide secure storage areas or stock 
rooms to prevent damage or deterioration of product, pending 
use or delivery. Appropriate methods for authorizing receiptand 
the despatch to and from such areas shall be stipulated. In order 
to detect deterioration, the condition of product in stock shall be 
assessed at appropriate intervals. 

The supplier shall control packing, preservation and marking 
processes (including materials used) to the extent necessary to 
ensure conformance to specified requirements and shall identify, 
preserve and segregate all product from the time of receipt until 
the supplier's responsibility ceases. 

The supplier shall arrange for the protection of the quality of 
product after final inspection and test. Where contractually spec- 
ified, this protection shall be extended to include delivery to 
destination. 


19.1 At each location practices and facilities shall ensure that 
documentation is handled, transmitted and stored in ways 
which avoid damage or deterioration. 


19.2 Certificates, reports, plans, software and the like being 
forwarded to clients and third parties, shall be specially 
protected to assure arrival in good condition. 


20. RECORDS 


The supplier shall establish and maintain procedures for iden- 
tification, collection, indexing, filing, storage, maintenance and 
disposition of quality records. 

Quality records shall be maintained to demonstrate achieve- 
ment of the required quality and the effective operation of the 
quality system. Pertinent sub-contractor quality records shall be 
an element of these data. 

All quality records shall be legible and identifiable to the 
product involved. Quality records shall be stored and main- 
tained in such a way that they are readily retrievable in facilities 
that provide a suitable environment to minimize deterioration 
of damage and to prevent loss. Retention times of quality records 
shall be established and recorded. Where agreed contractually, 
quality records shall be made available for evaluation by the 
purchaser or his representative for an agreed period. 


20.1 Procedures shall be established and maintained at each 
location for maintaining records. These records will 
demonstrate achievement of the required quality and the 
effective operation of the quality system. 


20.2 The procedures shall state: 
20.2.1 The documents which shall be kept at the location. 
20.2.2 The requirement for record maintenance systems 
including the provision of master lists. 
The person(s) responsible for reviewing each docu- 
ment for adequacy before filing. 
The file identification and maintenance procedure. 
The person responsible for safe-keeping in files and 
archives. 
20.2.6 The archive retention periods. 
20.2.7 Requirements for periodic examinations. 
20.2.8 The environmental requirements. 
20.2.9 The back-up requirements. 
20.2.10The retrieval procedure. 


20.2.3 


20.2.4 
20.2.5 


20.3 Records shall be maintained in accordance with these 
procedures. 


21. INTERNAL QUALITY AUDITS 


The supplier shall carry out a comprehensive system of planned 
and documented internal quality audits to verify whether quality 
activities comply with planned arrangements and to determine 
the effectiveness of the quality system. 

Audits shall be scheduled on the basis of the status and impor- 
tance of the activity. 

The audits and follow-up actions shall be carried out in accor- 
dance with documented procedures. 

The results of the audits shall be documented and brought to 
the attention of the personnel having responsibility in the area 
audited. The management personnel responsible for the are shall 
take timely corrective action on the deficiencies found by the 
audit (see 4.1.3). 

The supplier shall identify in-house verification require- 
ments, provide adequate resources and assign trained personnel 
for verification activities (see 4.18). 

Verification activities shall include inspection, test and moni- 
toring of the design, production, installation and servicing 
processes and/or product design reviews and audits of the quality 
system, processes and/or product shall be carried out by person- 
nel independent of those having direct responsibility for the work 
being performed. 


21.1 There shall be a comprehensive system of planned and 
documented internal quality audits of the quality-related 
activities in all locations. 


21.2 Audits shall be carried out to verify whether or not the 
quality related activities comply: 
21.2.1 with the requirements of this document, 
21.2.2 with the procedures in force in the location, 
21.2.3 with the requirements of contracts in hand. 


21.3 Audits shall be scheduled and arranged by the manage- 
ment representative for the quality system in conjunction 
with the regional and divisional heads and carried out as 
follows: 

21.3.1 Each local office 
— by regionally-appointed auditors. 
21.3.2 Each division 
— by divisionally -appointed auditors. 
21.3.3. Corporate 
— byauditors appointed by the management repre- 
sentative for the quality system. 


21.4 Audits shall be carried out at a frequency commensurate 
with the volume and importance of the work being done 
in the location and the findings of previous audits the stan- 
dard being once per year. 


21.5 An audit shall cover all the work of the location. 


21.6 Audits shall be carried out in accordance with procedures 
incorporating check lists. 


21.7 Auditors shall have successfully completed approved 
training courses in quality system auditing. 


21.8 Auditors shall be selected by regional or divisional heads 
as appropriate with the concurrence of the management 
representative for quality. 


21.9 The findings of the audits shall be documented and 
brought to the attention of personnel having responsibility 
for the supervision of the location audited. 


21.10 The personnel responsible for the supervision of the 
location audited shall take timely corrective actions on 
any non-compliances found by the audits. 


21.11 The corrective actions shall be followed up by the audi- 
tors to verify their implementation and effectiveness. 


22. NON-COMPLIANCES AND CORRECTIVE 
ACTIONS 


The supplier shall establish, document and maintain procedures 

for: 

a) investigating the cause of nonconforming product and the 
corrective action needed to prevent recurrence; 

b) analysing all processes, work operations, concessions, 
quality records, service reports and customer complaints to 
detect and eliminate potential causes of nonconforming 
product; 

c) initiating preventative actions to deal with problems to a 
level corresponding to the risks encountered; 

d) applying controls to ensure that corrective actions are taken 
and that they are effective; 

e) implementing and recording changes in procedures result- 
ing from corrective action. 


22.1 These requirements refer to LR’s product. 


identification of non-compliant products, (includ- 
ing consequential noncompliances) on discovery. 
evaluation and decisions on actions to be taken. 
recording the non-compliances and actions taken. 
investigating the cause of the non-compliance and 
the corrective action needed to prevent a recur- 
rence. 

5 analysing all procedures, practices and records to 
detect and eliminate potential causes of non- 
compliances. 

initiating preventative actions to deal with prob- 
lems to a level corresponding to the risks 
encountered. 

applying controls to ensure that corrective actions 
are taken and that they are effective. 
implementing and recording changes in procedures 
resulting from corrective action. 


22.3 Procedures shall be established and maintained for inves- 
ligating clients complaints. Where investigation finds that 
LR product (certificate, report, etc.) was non-compliant, 
corrective action shall be taken as described above. 


22.4 Where necessary for the fulfilment of a contract of services 
toa purchaser procedures shail be established in each loca- 
tion to ensure that major noncompliances and their 
corrective actions are notified to the purchasers QAR. 


23. MANAGEMENT REVIEWS 


The quality system adopted to satisfy the requirements of this 
International Standard shall be reviewed at appropriate intervals 
by the supplier's management to ensure its continuing suitability 
and effectiveness. Records of such reviews shali be maintained 
(see 4.16). 


NOTE — Management reviews normally include assessment of 
the results of internal quality audits, but are carried out by, or 
on behalf of, the supplier's management, viz management 
personnel having direct responsibility for the system. (See 4.17). 


23.1 The quality system adopted to satisfy these requirements 
shall be reviewed at appropriate intervals not exceeding 
twelve months. 


23.2 The object of the reviews is to ensure that the quality objec- 
tives are being achieved and the continuing suitability and 
effectiveness of the quality system established. 


23.3 The reviews shall be carried out at meetings of the following: 
In each office or department 

The head and the senior staff of the office or depart- 
ment. 

In each Division 

The head of the division and the heads of depart- 
ments and offices in the division. 

In each region 

The head of the region and the heads of offices in 
the region, wherever practicable. 

In Lloyd’s Register (Corporate) 

The Chairman of Lloyd’s Register, the Quality 
Committee and the management representative for 
quality. 


23.4 The following matters shall be addressed at each review 
meeting at each location: 
23.4.1 Ananalysis of complaints addressed to the location 
(a) from within LR 
(b) from clients 
and corrective actions. 
An analysis of system, document and activity moni- 
toring results and corrective actions. 
The results of internal audits of the quality system 
at the location and corrective actions. 
The results of external audits of the quality system 
at the location and corrective actions. 
The effectiveness of controls within the location, 
including monitoring. 
Each manual, procedure, and work instruction in 
the quality system produced within the location. 
(See also paragraph 9.2.13. under Document 
Control). 
Reports of reviews held at lower-tier locations, 
(applicable to regional and corporate reviews). 
Any notable changes to other LR quality system 
documents or national or other standard s or other 
documents having a bearing on the quality system 
at the location. 
Any other matters bearing upon the quality of LR’s 
products. 


23.4.9 


3.5 Allreview meetings shall be subject to an agenda and shall 
be minuted. Copies shall be retained on file at the location 
concerned. 


24. TRAINING 


The supplier shall establish and maintain procedures for identi- 
fying the training needs and provide for the training of all 
personnel performing activities affecting quality. Personnel 
performing specific assigned tasks shall be qualified on the basis 
of appropriate education, training and/or experience, as required. 
Appropriate records of training shall be maintained (see 4.16). 


24.1 Procedures shall be established at each location for: 
24.1.1 identifying the skills required to fulfil each post in 

the location. 

identifying training needs of personnel. 

providing training for personnel. 

maintaining records, or readily accessing records, 

of the training and experience of the personnel at 

the location. 


24.1.2 
24.1.3 
24.1.4 


25. STATISTICAL TECHNIQUES 


Where appropriate, the supplier shall establish procedures for 
identifying adequate statistical techniques required for verifying 
the acceptability of process capability and product characteristics. 


25.1 Where sampling methods are to be used by the Surveyors, 
a system shall be established to determine the sample 
levels and acceptability criteria. 


25.2 Procedures shall utilise statistical techniques where appro- 
priate. 

25.3 Any sampling procedure used in the fulfilment of a 
contract of services will be stated and agreed with the 
purchasers QAR. 


26. ACCOMMODATION AND ASSISTANCE 
FOR CLIENT’S QAR 


26.1 General 


AQAP - | requires that material and services be designed, 
manufactured and provided so as to conform to the require- 
ments of the purchaser and that the activities involved be 
effected as economically as practicable. To achieve this the 
purchaser has the right to appoint a QAR with the freedom to 
check any aspect of the quality system at any time including at 
sub-contractors premises. 


26.2. Accommodation and Facilities 


LR will provide the QAR with accommodation and facilities 
as required for the proper.accomplishment of his work and shall 
provide assistance as required by the QAR for verification, 
documentation, or release of material. 


26.3 Right of Access 


26.3.1 The QAR has right of access to any area of LR’s 
premises where any part of the contracted work is 
being performed. 

26.3.2 The QAR will be afforded opportunity to verify 
compliance with quality assurance system proce- 
dures and conformance of material and services 
with contract requirements. 


26.4 Availability of Inspection Equipment and Personnel 


LR will make inspection equipment available for reasonable 
use by the OAR for verification purposes, LR personnel will 
be available for operation of such inspection equipment as 
required. 
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SYNOPSIS 


Electrical machines are an example of a mature technology, but 
one in which there are still some interesting developments and 
operational problems which require solution. 

Since electrical machines are a complicated assemblage of 
copper, insulating materials and magnetic steel it is to be 
expected that, occasionally, difficulties arise. Problems with 
bearing currents, core heating, harmonics, induction motor 
starting and single phase operation occur periodically to remind 
us of the need to be aware of the complexity of electrical 
machines. 

This paper is concerned with a review of some of the prob- 
lems which have occurred in recent years and considers some 
of the developments in machine design and application. 


WwW 


1. INTRODUCTION 


Electrical machines are an example of mature technology since 
all the common types, direct current (dc) and alternating 
current (ac) machines such as induction motors and 
synchronous machines are over 100 years old. It was in 1888 
that Nikola Tesla took out a patent for the polyphase induction 
motor and in it described an arrangement comprising a gener- 
ator, power transmission and induction motor. It was a number 
of years however before this new polyphase arrangement 
achieved real acceptance, one reason being that it required 
more wires than the then existing de arrangements. 

Since those early days electrical machines have undergone 
a process of steady development with a noticeable feature being 
an improvement in both insulating and magnetic materials. 
There has also been better utilisation of materials and improve- 
ment in cooling arrangements which have resulted in machines 
becoming smaller for a given output. The maximum output has 
also advanced, and ac generators of 1300MVA are now in 
service. 

Recent developments in machine drives technology have 
been directed towards the goal of an economic brushless vari- 
able speed drive system. Modern electronics have brought big 
changes, and this is a very active area of development. 

Developments in computers and complex finite element 
programmes have enabled academics, and some industrial 
organisations, to gain a deeper understanding of the electro- 
magnetic processes taking place within machines. 

Although there is this long history and active development, 
machine operational problems seem to follow well established 
paths. It is intended in this paper to mention some of the prob- 
lems which have occurred recently. Even with the most 
sophisticated computer based design procedures it is still neces- 
sary to produce machines using manufacturing processes which 
have not changed significantly for many years. There is still the 
need for quality control and surveys and it is essential that these 
are correctly targeted. 


2. MACHINES 


An electrical machine is a complex assemblage of copper, insu- 
lation and magnetic sheet steel with some form of enclosing 
frame and cover. It is the complexity of the electro-magnetic 
assembly that presents the challenge to the designer of electri- 
cal machines and _» »vides the reason for the most common 
failures. 
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Fig. 1 Electrical Machines 


In order to limit the scope of this paper it is proposed to 
restrict the discussion to three phase ac machines since these 
are by far the most common machine in modern marine 
systems. Single phase ac machines, although economically very 
important, tend to be restricted to small sizes and to form part 
of domestic white goods. Some of the problems of three phase 
machines appear also in single phase machines and are there- 
fore applicable to both. 

No excuse is made for excluding de machines, they are an 
interesting class of machines with their own set of problems, 
usually associated with commutators and __ brushgear. 
Unfortunately de machines do not feature in many recent 
marine systems. 

Fig. 1 is a much simplified illustration of the basic electrical 
machine with windings on both the stator and rotor. The main 
ac supply is normally connected to the stator winding, although 
rotor fed designs have been used in the past for some small 
machines. The magnetic core of the stator is laminated and the 
windings are located in slots punched in the lamination. 

The requirements for a satisfactory core and windings are 
discussed in later sections of the paper but these two elements 
represent the heart of the machine. Unfortunately core and 
winding problems still occur. 


3. STATOR WINDINGS 
3.1 Winding Types 


The stator winding of an ac machine takes a number of forms 
depending on the machine rating and voltage with Fig. 2 illus- 
trating some of the options. 

The windings of electrical machines consist of multiturn coils 
of insulated copper wire or strip which are connected between 
the motor terminals. The coils are laid in slots on the inner 
periphery of the stator core and the number of coils is equal to 
the number of slots. The supply voltage is equally divided across 
the coils that are connected in series and the coil voltage is then 
sub-divided by the number of turns to give the voltage per turn. 
It is important that the design does not exceed accepted levels 
of voltage per coil, or volts per turn, because of the danger of 
electrical breakdown between wires. 

For induction motors intended for service at 440 volts, or 
even 660 volts, the most common winding arrangement will be 
the mush, or random, type using round wires insulated with a 
suitable enamel. The wire is first made up into loosely formed 
coils of the correct number of turns, these are then inserted, by 
hand, on a wire by wire basis into the slots which have a lining 


of insulating material already in place. When the bottom coil 
is in position the separator is inserted and when both top and 
bottom coils are in position the slot wedges will be inserted. 
The coil ends will then be joined in the end winding overhang 
to give the correct winding configuration, the whole assembly 
given a coating of a suitable insulating varnish and then baked 
in an oven. 

With small and medium size induction motors it is necessary 
to have the slot opening as narrow as possible. If the design 
requires the use of rectangular coils then one approach that is 
feasible for a low voltage winding is to use the half width offset 
slot opening, see Fig. 2b. Coils using rectangular conductors 
can be formed into more precise shapes than round wire coils 
and for high power and high voltage machines this is an 
advantage. 

Round wire mush windings have the disadvantage that the 
arrangement of the wires in the slots is random and the voltage 
between adjacent wires, which should be the voltage per turn, 
could be much higher. If the first and last turn happen to be 
adjacent to one another then the voltage between conductors 
would be the coil voltage rather than the turn voltage. With 
rectangular conductors the arrangement is orderly and the volt- 
age between conductors is restricted to the voltage per turn. 
However round wires are preferred for economic reasons and 
are used for most low voltage induction motors. Mush windings 
should not be used for high voltage motors because of the prob- 
lem with the control of the voltage between conductors. 

High voltage windings have the slot insulation wrapped 
around the coil sides before they are inserted into the machine, 
the winding being pressed to its final dimensions and then 
inserted into open slots as shown in Fig. 2c. 

Whichever form of winding is used the coil wire, or strip, is 
supplied insulated with an enamel. 


3.2 Manufacturing Stresses and Tests 


During manufacture the winding wire has to be transferred 
from its transport drums or packs, wound into a coil shape using 
formers of one type or another and then fitted into the stator 
slots. The endwinding overhangs are then shaped and arranged 
to the required form, winding connections brazed on, the whole 
assembly impregnated in varnish and baked prior to being 
subjected to a high voltage test intended to demonstrate the 
electrical integrity of the insulation system. 

This sequence of operations involves stretching, bending, 
abrasion, heating and electrical testing all of which impose 
considerable mechanical and electrical stress on the winding 


Fig. 2 Motor Slot and Winding Arrangements 


wire and its insulation. It is essential therefore that the insulated 
Wire is manufactured to comply with an accepted national or 
international standard. A motor manufacturer may however, 
find that itis necessary to have requirements additional to those 
given in the standard because of his manufacturing procedures 
or machine design requirements. 

It is impractical to test all the wire used in the manufacture 
of a range of motors, so it is necessary to resort to sample tests 
and these are covered in the standards. Quality control proce- 
dures should ensure that each reel or batch of wire has been 
checked in accordance with the design specification so that if 
there is a subsequent fault it can be traced back to its source. 

One simple test for the quality of enamelled round wire is 
the “pin hole test”. This is an electrical test which checks the 
continuity of the insulation by subjecting it to an electrical stress 
whilst the wire is passing through rollers. The number of local 
faults, or pinholes, in the insulation are recorded and in a 
30 metre length a count of zero would be ideal but at least one 
manufacturer claims that even 20 faults may be acceptable 
because the chance of two pinholes coinciding in the winding 
is very remote. The standards however set a limit of 6 faults in 
a 30 metre length. 


3.3 Operational Stresses 


During operation a motor winding is subjected to voltages from 
the supply, and these may contain high frequency components 
or spikes especially if there are inverters involved. The winding 
is also subject to mechanical stress because of the alternating 
currents in the wires and, since the electromagnetic force is 
proportional to the square of the current, the effects of a high 
starting current can be quite severe. There are in addition the 
effects of contamination and moisture in the ambient surround- 
ing the machine and in marine installations this always means 
a salt laden atmosphere with a strong possibility of oil contam- 
ination. Finally there is the temperature cycling as the motor 
load changes from no-load to full load. 

Because of space constraints within the slots of the motor 
the thickness of insulation used on the winding wire or strips is 
very thin, being typically 0.05mm and it has to be remarkably 
strong. It is a credit to the insulation engineers skills that the 
life expectancy of electrical machines is as high as it is. 
Unfortunately there are still failures and in new machines these 
are often due to faults in the insulation materials that the tests 
have not revealed, perhaps combined with manufacturing prac- 
tices that have fallen short of the standard normally expected. 
Contamination of the windings, combined with its age, is 
perhaps the most common cause of winding failure in machines 
which have been in service for some time. 


3.4 Winding Failures 


It is often very difficult to be precise about the cause of a stator 
winding fault Fig. 3 has a view of the stator winding of a LOMVA 
ac machine that had suffered a very localised fault. The top of 
the winding (not shown) had the copper of the coils exposed 
and there was severe, but local, damage, whilst the view from 
the bore of the machine shows a coil side almost burnt away. It 
appeared as though a hole had been burnt through the winding. 
The machine was repaired in situ by replacing the damaged coils 
and it was returned to service in a very short time. The cause of 
the fault was never determined but contamination, by a loose 
piece of metal perhaps, was considered possible; the damage 
had destroyed any evidence. The damage was restricted because 
the protection system of the installation included a differential 
protection relay for the generator and it was this relay which 
had operated, opening the generator circuit breaker and at the 
same time removing the excitation from the machine. 


Fig. 3 Stator Winding Fault 


Similar problems with fault diagnosis have been presented 
by other failures, (Fig. 4) where the damage is so extensive that 
it is only possible to state that there had been a winding fault. 
In this case the end packet of laminations had to be replaced 
because they were so badly damaged and for this operation it 
was necessary to remove the machine from the vessel and trans- 
port it to the manufacturers works for repair. 


Fig. 4 Stator Winding Fault with Core Damage 


Since the insulation on the winding copper is very thin it is 
essential that this should not be subject to unnecessary electric 
stress. The endwindings of machines with round wire coils are 
particularly susceptible to problems with voltages between 
wires because of the random nature of the arrangement and it 
is essential that wires from different slots are not mixed together. 
Barriers formed from insulating material should be inserted to 
ensure that wires from different supply phases are kept apart. 
Fig. 5 is a picture of part of the endwinding region of a mush 
wound motor and it illustrates what should be achieved. 

A recent motor failure was attributed to possible material 
problems with the wire insulation but this may not have been 
important if there had not been cross-overs of wires in the 
endwindings. There was therefore a higher than designed volt- 
age between conductors which, with the suspect insulation, 
resulted in a failure. 


Fig. 5 Motor Endwinding 


4.0 STATOR CORES 
4.1 Stator Core Construction 


The stator core of an ac machine is made up of thin magnetic 
sheet steel laminations which are individually insulated to 
restrict the flow of eddy currents. The insulation must be as thin 
as possible in order to increase the space factor of the core and 
the favoured materials are either a varnish or an inorganic coat- 
ing. The laminations have to be assembled and clamped to 
provide a rigid structure capable of accepting the winding which 
is located in the slots on the inner surface of the core. The 
mechanical problems in the design of the core and its retaining 
structure are the determination of the required clamping pres- 
sure and the maintenance of this pressure in service. Any 
slackness which develops in the core and permits the lamina- 
tions to move relative to one another may lead to vibration and 
failure of the winding insulation. 

In small and medium sized machines the stator frame 
which is used to contain the core may form the main retaining 
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structure. With larger machines there may be a stator core 
pack (Fig. 6), comprising the core and clamping structure 
which is inserted, when fully wound, into the stator frame or 
mounted on a baseplate and provided with a light cover for 
protection. 

The core pressure may be maintained by using bolts (Fig 6a) 
or the laminations may be welded, a form of construction which 
turns the core itself into a major structural member. The lami- 
nations are welded together along the length of the core at 
several locations on the outer surface; the laminations being 
held under pressure for this welding. This form of construction 
is widely used for smaller motors. 

Where welded cores are used for larger machines it is normal 
practice to weld the laminations to the bars of the stator cage 
and dispense with the bolts, an example of welded corepack is 
shown in Fig. 6b. 

Support at the ends of the core for the stator teeth can 
present problems and on large machines it is necessary to 
provide tooth supports that are part of the clamping structure 
and are strong enough to provide restraint to the tooth along 
its length. Unfortunately the leakage fluxes at the end of the 
core can induce significant eddy current losses in the tooth 
supports. One technique to reduce the loss is to split the tooth 
supports and this was used on the LOMVA machine (Fig. 3). 

Whatever the constructional arrangement adopted the 
clamping forces have to be adequate to maintain a satisfactory 
pressure on the core without the pressure being excessive, as 
this could involve a requirement for an increase in the strength 
and cost of the structure. With time there tends to be a relax- 
ation in the pressure as the laminations bed down under the 
influence of magnetic forces and thermal cycling. It isimportant 
that the structure and the original pressure are designed to 
allow for this reduction. 

It is usually only with large machines that problems with 
loose cores are manifest, generaily at the ends. The small, mass 
produced, motor’s mechanical structure is much simpler and 
the volume of production permits the development of a thor- 
oughly satisfactory mechanical arrangement. With large one 
off designs there are often slight variations in the construction 
from one machine and its closest, earlier, model and this is a 
possible source of design mismanagement. During the manu- 
facture of machines with long cores it is necessary to press the 
core at intermediate stages during the building process to 
ensure that the laminations are sufficiently compacted. 


Fig. 6 Stator Core Pack 
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4.2 Circulating Currents in the Core 


Since the laminated core carries an alternating flux it is impor- 
tant that there are no electrical circuits linking this flux 
otherwise there will be circulating currents and heating effects. 
This imposes restraints on the arrangement of the core clamp- 
ing because if any bolts pass through the core, then these must 
be insulated to ensure that they, and their endplates, do not 
act as a cage winding in the stator which being linked by some 
of the stator flux would have a circulating current induced. 

Core clamping bolts or ribs that are outside the magnetic 
circuit usually present no problem because they are linked only 
by a very low leakage flux. However if an arrangement is used 
where the bolts pass through keyhole slots at the back of the 
core (Fig. 6) then there will be some flux linking the boits and 
a likelihood of circulating currents with uninsulated bolts. 

There have been at least two cases where a core construc- 
tion as illustrated has resulted in circulating currents which 
resulted in damage to the core and clamping structure. In one 
instance the stator core was reported to be glowing red hot in 
places on the outer periphery where the current was flowing 
from bolt to core. The nuts on the ends of the clamping bolts 
had also been subjected to high temperatures resulting in local 
melting of some of the washers under the nuts. 

The form of construction used was standard for this partic- 
ular manufacturer and the reason for the failure in these two 
machines was difficult to explain. Both machines, however, had 
experienced operational difficulties after several months in 
service and during the checks carried out at that time it was 
found that the nuts on the clamping bolts could be tightened 
up a little. There were no other problems with the nuts. It was 
during a later routine inspection that the heating effect was 
noticed on the bolts and further checks revealed the local core 
heating. 

A possible explanation is that the relaxation in the core 
which takes place during the first few hours of service was suffi- 
cient, on most machines, to provide an increase in electrical 
resistance at the nuts. This resistance would have been reduced 
when the nuts were tightened and circulating currents could 
then flow. Perhaps this was a case of a cure for one minor fault 
resulting in a more major problem, and one more example of 
the care which has to be exercised in supervising work on 
equipment. A complicating factor was that the machines were 
subjected to high harmonic currents because of convertor 
equipment connected to the ac system. 

Although the core was damaged on the outer periphery, 
and the extent of the damages was found to increase with time, 
the windings were not affected and the machine remained in 
service until a replacement core pack had been manufactured. 
The machine manufacturer changed the design for the replace- 
ments, using a welded construction instead of the original 
bolted arrangement, the provision of adequately insulated 
bolts was considered to be uneconomic. In fact later costings 
showed the welded construction to be cheaper than the original 
bolted method. 


4.3 Interlaminar Faults 


Core faults which result in a breakdown in the interlamination 
insulation are quite rare but if they occur at the air gap then 
the situation shown in Fig. 7 can result with circulating currents 
in the laminations. There may be eventual failure of the wind- 
ing due to the heating effects in the core at the air gap. Because 
of the danger of damage to the stator core at the air gap surface, 
care must always be exercised when inserting or removing the 
rotor. Ideally there should be some form of mechanical protec- 
tion in the air gap but this is not always practical on induction 
motors which have very short air gaps. 


There are available portable core testing devices which 
permit a rapid assessment of core integrity. They work by using 
an excitation winding to produce an alternating flux around the 
ring of the stator core, as in a ring test, and the detector is based 
on the Chattock, or Rogoski principal to measure magnetic 
anomalies at the stator bore. This is an improvement on the 
basic ring test where the method of checking is to feel for hot 
spots. 


Damage to 
Laminations 
at Air Gap 


Ss 


Fig. 7 Current in Core with Interlaminar Fault 


On very large machines there is the problem with leakage 
fluxes at the end of the core, which has already been mentioned 
when discussing tooth supports. Heating of the end plates and 
tooth supports with vibration of the laminations are two of the 
most noticeable effects. On the largest two pole generators it 
is necessary to provide flux shields with some form of cooling 
arrangements to safeguard the ends of the machine. There 
have been cases of failure of parts of the core clamping assem- 
bly because of the vibration introduced by the leakage flux. 
Finger supports have failed in at least one machine and there 
has been fretting of laminations at the end of the core in 
another. 

Examination of the core of large electrical machines should 
always be undertaken when the machine is opened for periodic 
cleaning or winding checks. 


5. SHAFT CURRENTS 


Voltages induced in the shafts of electrical machines, and the 
currents which these may cause to flow, can result in rapid fail- 
ure of bearings. It is common practice on large machines to 
insulate one of the bearings so that the electrical circuit is 
broken and bearing currents suppressed. 

The most important cause of bearing currents is an alter- 
nating ring flux in the stator core which links the rotor and this 
is shown in Fig. 8. Also shown is the circuit in which the current 
would flow if permitted. The ring flux can be caused by either 
an eccentric rotor or a segmental core. 

With increasing size of machines it becomes uneconomic to 
use complete rings for the stator laminations, instead the core 
is built up of segments which are butted together with the joints 
displaced in alternate layers. It may also be necessary to build 
the core in sections because of transportation limitations. 


Ring flux linking 


Current 


Fig. 8 Bearing Current Caused by Ring Flux 


The effect of joints in the magnetic circuit is illustrated in 
Fig. 9 which shows the mechanism whereby the joints cause a 
flux to link the shaft. 

The magnetic circuit has a much higher reluctance at A-A’ 
than at B-B’ and there will be a tendency for pole | to send 
more of its flux to pole 2 rather than pole 4. The same will 
happen for 3 and 4. This unequal distribution of flux can be 
represented as a uniformed distribution in the poles with a 
ring flux, superimposed as illustrated in Fig. 10. As the poles 
rotate the pole in position | will be alternatively north and 
then south so the flux linking the core will alternate. 

An eccentric rotor has a similar effect because there will 
be a tendency for the flux to be greatest where the air gap is 
shortest. The unequal distribution of flux which results can 
again be represented as the sum of equal pole fluxes and a 
ring flux. 

Although the illustration is for a simple two joint arrange- 
ment, such as may occur in a machine which is to be split for 
transport, the concept is equally applicable to a situation with 
many joints as when segmental lamination are used. 


Fig. 9 Unsymmetrical Fluxes cased by Stator Joints 


The result of this asymmetry in the flux is to have an alter- 
nating flux linking a closed electrical circuit which will result in 
a current flow. 

There are a number of rules regarding whether or not shaft 
currents are likely and one for a sectionalised stator is: 

(1) Sectionalizing the stator will cause shaft currents if the ratio 
of twice the number of joints to the number of poles, 
expressed as a fraction reduced to its lowest terms, has an 
odd number for its numerator. The frequency of the shaft 
currents will be equal to this numerator times line 
frequency. If the numerator is an even number, no shaft 
currents will appear. 

or expressed for segmented laminations with overlapping joints: 

(2) The use of symmetrical segmental punchings will cause 
shaft currents if four times the segments over the poles, 
expressed as a fraction reduced to its lowest terms, has an 
odd number for its numerator; and the frequency of the 
shaft currents will be equal to this numerator times line 
frequency. 


Fig. 10 Symmetrical Fluxes with Ring Flux 


Regardless of the rules it is always wise to have insulated 
bearings for large machines and to ensure that hand rails, water 
pipes, oil pipes and instrumentation cables and their screens do 
not short out the insulation. 


6. SINGLE PHASE & UNBALANCED 
OPERATION OF INDUCTION MOTORS 


Single phasing of a three phase induction motor is the extreme 
case of the general unbalanced supply voltage condition, and it 
can be caused by a fuse blowing in one of the supply lines. 


6.1 Unbalanced Operation 


Induction motors are designed for operation with a balanced 
three phase supply, that is where the voltages between all three 
lines are identical in magnitude and are at 120° intervals. A rela- 
tively minor unbalance, say 5% difference in the voltages, can 
result in a 20% increase in current in one phase. This large 
change incurrent for a relatively minor difference in the voltages 
is due to the negative sequence component of voltage that is 
present in the unbalanced supply voltage. 


For the general unbalanced case the increase in current is 
related to the degree of unbalance in the supply, and the values 
of the positive and negative sequence impedances of the 
machine. It is not easy therefore to make precise statements 
about unbalanced operation, and it is wise to obtain the manu- 
facturers advice when there is a requirement to operate a motor 
with an unbalanced supply. 


6.2 Single Phase Operation 


A three phase induction motor will not start on a single phase 
supply but if it is running at rated speed when one supply line 
is lost then it may continue to operate. The peak torque devel- 
oped by the motor when supplied single phase is approximately 
half that which would be available with a three phase supply. 
However the standards require induction motors to have a peak 
torque of 1.6 times the rated torque and a figure of 2 times is 
quite common. With a single phase supply therefore the motor 
may well be capable of supplying full load torque. However this 
general statement may not apply to a particular machine and 
motor stall at high loads is not unknown. 

The currents flowing will naturally be restricted to the two 
healthy supply lines and will result in an abnormal operating 
state for the motor. In practice the currents in the healthy lines 
will be increased above the normal balanced operating condi- 
tion, but if the load is less than 50% of rated load then the 
currents are unlikely to exceed full load values. If the motor is 
delta connected the winding connected directly between the 
two healthy lines will carry more current than the other two, 
which are connected in series across the supply. Even with 50% 
load and less than rated current in the supply lines, one phase 
of the winding will have approximately 1.2 times rated current. 
The total power loss, in the whole of the stator winding, will be 
less than the normal full load value but most of it will be in one 
phase. A burnout of the motor is possible. 

The unbalanced stator currents result in negative sequence 
currents flowing in the rotor windings, and these tend to cause 
more heating than an equal level of positive sequence currents. 
Damage to the rotor winding is therefore possible. 

A simple overcurrent relay is not able to provide adequate 
protection to a single phased induction since it does not make 
allowance for the additional heating introduced by the abnor- 
mal current distribution. Any relay that is intended to provide 
satisfactory protection for induction motors must incorporate 
circuits which make allowance for the heating effect of unbal- 
anced currents. 


6.3 Three Phase Voltage with Single Phase Supply 


Occasionally it is proposed that loss of one supply line can be 
detected by use of a voltage relay which checks the three supply 
voltages to the motor. This technique is subject to limitations 
because of the voltages generated within the motor windings 
when operating on a single phase supply. This effect is used to 
provide three phase loads from a single phase supply. 

The Ferraris-Arno system is a means of providing a three 
phase supply from a single phase source. It makes use of the 
fact that a three phase motor running on a single phase supply 
generates a balanced three phase system of voltages which 
appear at its terminals. These three phase voltages can be used 
to supply other loads which require a 3 phase supply. 

Although the arrangement is not nowadays used as a regular 
means of providing a three phase supply it does have implica- 
tions with regard to motor protection. A voltage relay that is 
intended to provide protection on loss of supply voltage on one 
line may be rendered ineffective since the motor will be produc- 
ing a more or less balanced set of voltages and the relay would 
therefore fail to detect loss of one line. 
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The only reliable method for detecting a single phase 
condition is to monitor all three supply currents and use an 
unbalance in these currents as the protective function. 

Operation of a motor on an unbalanced supply, for which 
the single phase condition is the extreme example, always 
results in additional heating and requires special precau- 
tions. 


7.0 STARTING LARGE MOTORS IN MARINE 
SYSTEMS 


When considering the effect of connecting large ac motors 
to marine power systems it is necessary to recognise that both 
the motor and the generators influence the transient voltage 
response of the system. 


7.1 Transient Response of Generator 


As an example of generator response, Fig. 11 shows the vari- 
ation in generator voltage when a fixed impedance load is 
switched on and then off. There is the initial dip in voltage 
when the load is switched on, followed by a rise as the auto- 
matic voltage regulator increases the field current. There is 
a slight overshoot but the voltage settles until the load is 
disconnected. Following the disconnection there is a rise in 
voltage followed by a decay until the AVR has brought the 
field current down to the no load level. 


Voltage 


Fig. 12 Generator Transient Response 


The voltage response associated with direct on line (DOL) 
starting of an induction motor takes the same form because 
of the shape of the induction motor current/speed charac- 
teristic. The current is at a high level, 4 to 6 times full load 
current, for most of the accelerating period falling rapidly to 
a low value as the motor reaches full speed, the effect there- 
fore is very similar to the switching on and off of a static, 
reactive load. 

Transient voltage dips such as that which follow the switch 
closing may present a serious problem. If the voltage dip is 
too great there could be malfunctions in other equipment 
connected to the system. An evaluation of the likely magni- 
tude of the voltage dip is therefore of prime importance in 
system design. 


7.2 Simple Calculation of Voltage Dip 


Computer based calculating procedures can provide reason- 
able estimations of the voltage response but they require a great 
deal of input data. A simpler approach is required and it is possi- 
ble to obtain results which give an acceptable accuracy by 
considering the circuit of Fig. 12. 

The generator has been represented by a voltage source 
behind some value of generator reactance and the induction 
motor by its standstill reactance. If per unit values are used, 
with the generator as base, then calculations are relatively 
straight forward since the generator voltage is 1.0. 

When the switch is closed the voltage will be divided between 
the two series connected reactances and provided a suitable 
value is used for the generator reactance this circuit gives a satis- 
factory, although approximate value, for the voltage dip. 

The premise behind the use of this circuit is that during the 
first few cycles following switch closure the AVR has little effect 
on the current in the generator field and the generator voltage 
is therefore unchanged. This is particularly true of brushless 
machines where the AVR has to act on the exciter field rather 
than directly on the generator field. The response of Fig 11 
shows that several cycles elapse before the voltage reaches its 
minimum value and during this time the AVR output has been 
increasing. The behaviour of a particular generator, with its 
exciter and AVR will be known in general terms and will be 
similar for a range of machines. 


Vm 


Fig. 12 Circuit Diagram for Generator Loading Switch 


The circuit of Fig 12 leads to the following set of equations, 
using: 

Vg = generator internal voltage = 1; 

Xm = motor per unit reactance to generator base; 

Xg = generator reactance; 

Vt = generator terminal voltage = motor voltage. 


Voltage developed across motor, Vt is Vg coeea 


Xm + Xg 
orifVg=1 Vt= __Xm__ 
Xm + Xg 
Dip in voltage is 1 -- Cr 
Xm+Xg Xm + Xg 


which is of course, the voltage developed across the generator 
reactance Xg. 

For this calculation to be of any value it is necessary to have 
a value of Xg which makes allowance for the actual generator 
reactance and the AVR response. For brushless machines with 
an AVR that has a response satisfactory for marine systems it 
has been found that: Xg = 1.15 x Xd’, that is the effective gener- 
ator reactance is 1.15 times the transient reactance. This will 
give an estimation of voltage dip which is likely to be slightly 
greater than will be experienced. 
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The value of motor reactance is the starting reactance and 
to express this to the generator base it is only necessary to divide 
the generator base current by the motor starting current. 


7.3 Fault Level and Voltage Dip 


In some instances all that is available with regard to generator 
reactances is the sub-transient reactance, Xd". Again there is 
arule of thumb approximation which states that transient reac- 
tance is 1.5 times the sub-transient reactance. Effective 
generator reactance Xg is therefore 1.725 times sub-transient 
reactance. 

Since there is now a relationship between sub-transient reac- 
tance and voltage dip it is possible to derive a simple 
relationship for motor rating and system short circuit capacity 
for a particular voltage dip. 

System fault KVA is approximately equal to 62 times motor 
kW for a 15% voltage dip. 

Unfortunately these simple relationships can only be used 
for establishing an order of magnitude effect, but they are a 
useful method for making quick checks on some of the more 
detailed calculations. 


8. REDUCED VOLTAGE STARTING 


Since starting large motors direct on line (DOL) can cause signif- 
icant transient voltage dips there is a need to consider starting 
methods which result in lower system disturbances. Table | has 
the four most common starting arrangements, the DOL starting 
and three reduced voltage methods, so called, because the volt- 
age applied to the motor phase windings is reduced during 
starting but is switched to the full rated value for the running 
condition. It is important to note the torque capability of the 
motor during the condition of reduced voltage supply. Induction 
motor torque is proportional to the square of supply voltage so 
that with half voltage there is only quarter torque. 

DOL starting is used wherever possible because it is the 
simplest and cheapest. Method 2, open transition star delta, is 
favoured for small and medium motors. Method 3 is a refine- 
ment of method 2 and does not find wide acceptance whilst 
method 4 is the most expensive and its use is generally restricted 
to the larger machines. 
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Fig. 13 Diagram for Star Delta Starting 


Table 1 - Starting Methods for Induction Motors 


No | Method of | Voltage | Starting Starting Nature of Torque No. of starts Aavantages Disadvantages 
| Start applied to torque current starting per hour 
motor duty 
% DOL value | % DOL value | % DOL value Starter limit 
1 Direct-on- 100 100 100 Rapid start | Fixed at. Not usually Cheapest, High starting 
line at max. max limited simplest, and current 
available most reliable 
torque 
2 | Star-delta 58 33,33 33,33 Light Fixed at one | Not usually Cheap and Fixed torque. 
(open starting third DOL limited simple. 6 motor 
transition) torque Reduced terminals. 
starting current | Open transition 
from star to 
delta may 
cause high 
transient 
torque and 
current 
[3 Modified [58 33;33 33,33 Light Fixed at one | Limited by Smooth Extra resistor. 
star-delta starting third DOL | transitional starting. Peak | Increased cost. 
(closed resistor rating | and transients 
transition) reduced 
4 | Auto trans- | 50 25 25 Light Tappings Limited by Much smoother | Costly 
former starting adjustable | transformer transition 
(closed 65 42 42 Normal to suit load | rating peaks 
transition) starting 
80 64 64 Heavy 
starting 


With any of the reduced voltage starting methods it is 
essential that the run-up performance of the motor is correctly 
evaluated. For this the motor speed-torque characteristic in 
the reduced voltage supply mode is required together with the 
speed torque characteristic of the load. It is also necessary to 
make allowance for any variation that may occur in the supply 
voltage and the load characteristic. Since pumps and fans 
represent the bulk of motor loads in a marine installation it is 
worth noting that with open discharge valves there can be 
difficulties during run up with reduced voltages. 


8.1 Star Delta Starting 


The star-delta arrangement is the most common reduced start- 
ing method in marine installations. The method involves 
starting the motor with its windings connected in star and then 
when the motor is up to speed reconnecting the windings into 
the delta connection. 


‘Switch on’ Accelerating Transition 


Transient in star 


Running in 
star 


Running 
in delta 


Fig. 14 Star Delta Start Oscillograph 


During the changeover from star to delta the motor is 
disconnected from the supply for a short period. During 
this period the motor begins to slow down and the motor 
internal generated voltage or back emf begins to decay 
exponentially with time and to change its phase angle rela- 
tive to the supply. The time delay during the transition has 
to be short, to avoid too large a change in speed, so that 
the motor voltage will not have decayed very much. It is 
necessary therefore that when reconnected the supply volt- 
age and motor voltage are in the most advantageous 
relationship. 

The preferred connection arrangement for a star delta 
starter is shown in Fig. 13. The merit of this arrangement 
is that it takes advantage of the 30° phase shift that exists 
between a star and delta connection. If during the delay, or 
off, period the motor voltage falls back by 30° then it will 
be in the correct phase position to be reconnected with 
minimum disturbance. 

It is rarely possible to achieve this ideal situation and 
some mismatch of angle is almost inevitable. 

A typical oscillogram for a star delta starting sequence 
is illustrated (Fig. 14). 

The high peaks of current at the initial switch on and at 
the reconnection are associated with the energisation of the 
magnetic circuit and as can be seen last only fora cycle or so. 


8.2 Starting Problems 


Unfortunately not all starting arrangements follow this 
sequence and on occasions the motor has not reached full 
speed when the transition from a star to delta is made. The 
reason for a failure to run up to speed is usually due to a 
lack of accelerating torque in the critical region of the run 
up. This is a particular problem with pump drives because 
of shape of the motor and pump speed/torque characteris- 
tics. 

Another reason for a transition before full speed is 
reached is that the timer relays in the control circuitry have 
been set up incorrectly; this fault is easily cured. 
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Fig. 15 Motor Torque Speed Characteristics 


Motor and pump speed torque characteristics are illustrated 
in Fig. 15 and with the supply system at 100% volts, the motor 
in the star connection and the temperature of the oil being 
pumped at 58°C there should be no problem. However in one 
installation during a motor start the supply voltage was reduced 
to 95% of rated value and the oil was not at 58°C but 25°C. The 
combination of these two affects gave an intercept at about 
128 rev/min and the motor could not accelerate beyond this 
speed in the star connection. 

When the connections were switched to the delta arrangement 
the motor torque was increased by a factor of three and the motor 
rapidly reached full speed. The oscillogram for this starting 
sequence is illustrated in Fig. 16. Although this start was successful 
the peak current, and its duration, caused problems with the over- 
current protection system such that most starting attempts 
resulted in trips during the transition. There had to be changes 

In this case the motors were replaced with others of an alter- 
native design which gave more torque margin in this critical area. 
An expensive change particularly as more than one vessel was 
involved and the motors were rated 325kW. 


Fig. 16 Starting Oscillograph, Inadequate Torque 


9.0 HARMONICS 
9.1 Supply System Harmonics 


A supply system waveform that is not a true sinusoid, but is 
distorted because it has a significant harmonic content, can 
present a range of problems. Harmonics rarely prove to be 
beneficial and are frequently found to be extremely trouble- 
some, particularly when capacitors are connected. A capacitor 
exhibits an impedance characteristic which decreases as the 
frequency increases, so that at harmonic frequencies the capac- 
itor impedance is much lower than at supply frequency. 
Relatively low values of harmonic voltages can result in signif- 
icant harmonic currents and overheating of the capacitor and 
its supply cables. Capacitors are widely used since they are fitted 
to provide power factor correction in fluorescent lighting 
circulfs. 

Some electronic equipment has been known to malfunction 
when operated ona distorted waveform and there may be prob- 
lems with additional heating in electric motors. 

There are essentially two possible sources for the harmonics 
present in a distribution system, they can be produced by the 
generator itself or they may be the result of loads which draw 
non-sinusoidal currents. These two sources are different in that 
one is voltage based and the other is current dependent. 


9.1 Generator Harmonics 


AC generators are expected to produce a waveform that is sinu- 
soidal with no significant harmonic content and there are 
requirements in the national and international standards with 
regard to the level of waveform distortion that is acceptable. The 
requirements can be phrased in a variety of ways, for example: 
“The maximum deviation of the waveform of voltage between 
line terminals from the equivalent sine wave, when superim- 
posed soas to give the least difference, shall not exceed 10 percent 
of the maximum ordinate of the equivalent sine wave. 

The equivalent sine wave shall be taken as one having the 
same root mean square (rms) value and same wavelength.” 

Alternatively it is possible to specify that the total harmonic 
distortion (THD) shall not exceed a particular level with no indi- 
vidual harmonic being greater than a set percentage of the 
fundamental. 

A further definition which appears in present national and 
international standards requires the telephone interference 
factor to be below a specified level. 

Whichever method is used to specify the permissible wave- 
form distortion the intention is to have a machine that produces 
a sinusoidal waveform. Fig. 17 shows two open circuit voltage 
waveforms and illustrates what can be expected from a well 
designed machine and what can be produced by a generator 
where certain of the fundamental guidelines have been ignored. 

Although it is not common, generators are occasionally 
produced which have a no-load open circuit waveform with a 
high ripple content as illustrated. This recording was taken on a 
1.3MW, 3kV generator built in 1990 after the manufacturer had 
tried some corrective action. The original was apparently much 
worse. The distortion is the result of having the stator winding 
in slots, which is of course the normal method of construction, 
and is one example of the problems inherent with this arrange- 
ment. 

Although the ripple is due to stator tooth-slot permeance vari- 
ations in the air gap, and is known as tooth ripple, the prime cause 
is the currents induced in rotor circuits by the permeance varia- 
tions. 

The frequency of the induced rotor currents is: 

Z2ESKEI 

where S is stator slots per pole; 

and f is the fundamental frequency. 


These rotor currents cause a variation at 2Sf in the main pole 
magnetomotive force (mmf) which is superimposed on the 
main pole mmf. The resultant is resolved into forward and back- 
ward moving components, relative to the rotor, to give the 
voltages induced in the stator winding. The stator frequencies 
will be (2S+1)f. 

The machine in question had 12 slots per pole and a 
harmonic analysis of the waveform showed the dominant 
harmonics to be at 1150 and 1250Hz; that is 23 and 25 times the 
fundamental frequency of S50Hz. 

As mentioned above the manufacturer tried to eliminate, 
or at least reduce, the harmonics and various techniques such 
as changing the rotor damper winding and offsetting the rotor 
salient poles were adopted but without being able to eliminate 
the ripple completely. The final modifications reduced the 
1150Hz component to a low value and left the generator with 
11% of 1250Hz. 

It was decided at this stage that the most satisfactory prac- 
tical option would be to provide a capacitor network for the 
380 volt system. The reasoning behind this was that at the gener- 
ator voltage of 3kV the only loads were some large induction 
motors and it was confirmed by the manufacturer that they 
would not suffer from the 1250Hz voltages. The motor reac- 
tance would be high at this frequency and therefore restrict the 
flow of harmonic currents into the motor. All other services 
were at 380 volts and supplied via transformers. 


Fig. 17 Generator Waveforms 


Capacitors would provide a low impedance to 1250Hz and 
currents at this frequency flowing in the generator and trans- 
former reactances would produce voltage drops and 
therefore attenuate the harmonic voltage. The installation 
was fitted with capacitors and measurements on the vessel 
indicate a harmonic voltage of 1% at 1250Hz on the 380 volt 
system. The vessel is operating satisfactorily. 


9.3 Load Induced Supply Harmonics 


Although equipment with magnetic circuits having iron 
cores, such as transformers and reactors, can result in third 
harmonic currents in the supply system these are not the 
major cause of the harmonic distortion found in many distri- 
bution systems. Static power convertor equipment is the 
major source of harmonic distortion because its method of 
operation involves the cyclic switching of current between 
the phases of the supply. 

The basic building block of most convertor equipment is 
the well known three phase bridge convertor. This can 
provide a de output from an ac input or an ac output from a 
dc input. Two units connected together via a de link can form 
a variable frequency inverter which is becoming the domi- 
nant means of providing variable speed drives. 

Consider the ac input — de output version, which is acting 
in the rectifier mode of operation. If the de circuit contains 
a large inductor then the de current will be smooth and the 
bridge ac input current will be rectangular block of current 
120° long, as shown in Fig. 18(a). This waveform is very 
amenable to analysis and it can be shown to have harmonics 
of order 5, 7, 11, 13 etc., times the supply frequency. 

The general equation for the harmonics in a convertor 
input current waveform is: 

(p.n + 1) 
where p is the pulse number, 6 for a 3 phase bridge and n is 
an integer 1, 2, 3... 

For the smooth de current condition the magnitude of the 
harmonic currents is the reciprocal of the harmonic number, 
thatis 1/5, 1/7, 1/11 etc., all times the magnitude of the funda- 
mental frequency component. This smooth de condition 
gives therefore the classic values of 20% of Sth, 14.3% of 
7th, 9% of 11th ete. 

Unfortunately the ac current never has the ideal shape of 
Fig. 18(a) because in practice the sides are curved and the 
tops have ripple because the de current has ripple. It is the 
de ripple which has the biggest influence on the magnitude 
of the harmonics and results in certain of them having values 
greater than the levels given by the simple theory. A typical 
ac current waveform is illustrated in Fig. 18(b). 

The distortion which is introduced into the voltage wave- 
form is well illustrated by Fig. 18(b) which is for a marine 
system with thyristor convertors feeding propulsion motors. 

The “notching” in the voltage waveform corresponds to 
the thyristor switching or commutation intervals and can be 
evaluated quite easily on that basis. To provide more 
detailed information on the frequency content of this voltage 
waveform it is necessary to conduct a harmonic penetration 
study. 


9.4 Harmonic Current Penetration 


The convertor can be considered as a generator of 
harmonic currents which are injected into the supply 
network. The supply system consists of inductive reactances, 
resistances and perhaps some capacitance. The injected 
convertor harmonics current therefore flow in these 
elements and cause voltage drops which, when summed, 
provide the notching of Fig. 18(c). 


Fig. 19 has been prepared to illustrate, in a simple way, 
the basis of a harmonic current penetration and also to show 
that a capacitor rather than reducing the voltage distortion, 
may in fact increase it. The parameters have been selected 
on the basis that the fixed load absorbs half the generator 
capacity and the convertor the other half. At the fundamen- 
tal frequency the load has a power factor of 0.8 but the 
inductive reactance is frequency dependent. 


(a) Idealised converter current 


(b) Convertor current 


(c) System voltage 


Fig. 18 Waveforms for 6 Pulse Convertor System 
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9.5 Reduction of Distortion 


There are two methods available for the reduction in the 
harmonic distortion produced by convertor equipment. The 
first is to increase the pulse number of the converter from 6 to 
12 by having two 3 phase bridges connected in either series or 
parallel. Fig. 20 illustrates this. A transformer is required in the 
supply to at least one of the bridges because a phase displace- 
ment of 30° is required and Fig. 20 illustrates the two options 
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(a) Generator with convertor load 
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(c) Generator with convertor, capacitor and transformer load 


Fig. 19 Distribution of 5th Harmonic Currents 


available, i.e. a transformer for each bridge or a transformer and 
reactor. The parallel connected bridges require an interphase 
transformer to ensure current sharing between the bridges. 

Fig. 21 shows the supply voltage waveform with a 12 pulse 
convertor. 

The second method of waveform improvement is to use a 
harmonic filter. These are resistance, inductance and capaci- 
tance networks arranged to offer very low impedance at the 
frequency of the convertor harmonic currents. They are 
connected to the supply system and offer a low impedance path 


Zz Zz 
TOO 
TOO 
TOO 

Fax Zz 


6 Pulse converter 


aA ER 


kee 


eo; 
jin 


—— 


12 Pulse converter - Series bridges 


Pare ran 
Interphase 
a a2 zB transformer 
Ne ee 
O00 > 
“000 * 
“O00 ™ 
7 DY EF AX 


12 Pulse converter - Parallel bridges 
Transformer and reactor in supply 


Fig. 20 Convertor Connections 


for the harmonic currents. Fig. 22 illustrates one phase of a filter 
network with the variation of its impedance with frequency. 
The improvements in the system waveform can be very notice- 
able and on one vessel the voltage distortion was reduced from 
26% to 6%. 

It is worth mentioning that the design of harmonic filters 
requires considerable computation and their use should not be 
undertaken without a detailed analysis of both steady state and 
transient conditions. Energisation transients in particular need 
to be considered. 
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Fig. 21 Voltage Waveform for 12 Pulse Convertor 
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Fig. 22 Harmonic Filter Frequency Response 


10. AC MOTORS AND INVERTERS 


One of the major developments in recent years has been the 
way in which static frequency changers and ac motors have 
come to dominate variable speed drive arrangements. 
Although de motors are still manufactured in significant 
numbers, their share of the drives market has fallen and the 
continued reduction in the cost of power electronics will 
encourage this trend. 

There is a wide range of inverters available for use with ac 
motors and this reflects the manner in which the industry has 
developed. Table 2 is an attempt to summarise some of the 
options. Table 3 gives a list of some of the common convertor 


terms 


Table 2 - Inverters for AC Motors 
VOLTAGE SOURCE INVERTER (VSI) 
2. CURRENT SOURCE INVERTER (CSI) 


3. FORCED COMMUTATED INVERTER 
3.1 Six step inverter (VSI or CSI) 
3.2 Pulse width modulator inverter (VSI or CSI) 


4. LINE COMMUTATED INVERTER 
4.1 Synchro-converter for synchronous motor 
4.2 Six step inverter for capacitor excited induction motor 


CYCLO CONVERTOR 


The earliest form of inverter was the de link voltage source 
six step, Or quasi-square wave inverter, so called because it had 
an output waveform that consisted of rectangular blocks of volt- 
age 120° long separated by off periods of 60°. This was applied 
to small induction motor drives and although technically attrac- 
tive there was no great demand in the early days because of the 
cost, complexity and size of the electronics. 

Developments in power electronics produced significant 
advances in six step inverter systems and also resulted in pulse 
width modulated (PWM) inverters becoming available at 
competitive prices. A PWM inverter when associated with vector 
control has provided an ac drive that is capable of the dynamic 
performance that can equal that of a convertor fed de motor. 


6 Step Inverter PWM Inverter 
a wil 
Vd (variable) Vd (fixed) Voltage 
Current 
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Fig. 23 Inverter Waveforms 


The output waveforms of the six step and PWM inverter 
systems are illustrated in Fig. 23. 

For the efficient operation of an induction motor with a vari- 
able frequency supply it is necessary for the voltage to be varied 
in step with the frequency. The motor requires a constant volts 
per herz supply system, that is at half rated frequency, for exam- 
ple, the voltage magnitude must be half the rated value. 


Table 3 - Converter Terms 


A circuit which converts ac to de or de to ac 
or acts as an ac to ac frequency changer 


Converter 


Rectifier A circuit which converts ac to dc 


Inverter A circuit which converts dc to ac 


DC Link 


Intermediate dc stage between two ac 
systems of differing frequency 


An inverter fed from a dc source which 
maintains a constant de current during an 
inverter switching cycle; a dc link with a large 
capacitor for example 


Voltage Source 
Inverter 


An inverter fed from a dc source which 
maintains a constant dc current during an 
inverter switching cycle; a dc link with a large 
inductor for example 


Current Source 
Inverter 


Quasi Square Wave A waveform having two rectangular blocks, 
of different polarity, each 120° wide and 


separated by off periods of 60° 


Pulse Width Aconstant dc voltage that is switched to give 

Modulation varying on and off periods so that the output 
approximates to a sine wave and has low 
harmonic content 

Commutation The switching action which transfers current 
from one arm of a bridge to the next arm 
that is to conduct 

Natural A commutation process which relies on the ac 

Commutation system to provide the energy to effect the 
transfer from one arm to the next 

Force A commutation process where energy 

Commutation sources within the convertor are used to 


effect the transfer of current from one arm of 
the bridge to the next 


Synchro-Convertor Adc link inverter which employs natural 
commutation and requires a synchronous 


motor 


An ac to ac convertor which has no 
intermediate dec link 


Cyclo-Convertor 


Because the output voltage of a six step inverter is deter- 
mined by the magnitude of the de link voltage this must be 
varied as the output frequency changes. The convertor provid- 
ing the de voltage must therefore be of the controlled type and 
it is usual to employ a fully controlled three phase thyristor 
bridge. 

The PWM inverter system however can operate with a fixed 
de voltage because both the magnitude and frequency of the ac 
output can be controlled by the mark space control of the 
inverter. A simple three phase diode bridge rectifier is therefore 
all that is required of the input convertor. 

In addition to being much simpler than a controlled rectifier, 
the diode arrangement has the advantage that it operates at a 
high power factor regardless of output frequency. The 
controlled rectifier of the six step inverter has a power factor 
which is a function of its dc output voltage and hence inverter 
frequency. At low frequency the power factor is low. This rela- 
tionship between power factor and dc voltage is common to all 
convertors of this type and is one of the reasons for the low 
power factors found on vessels with large, convertor fed, dc 
motors. 

Both the voltage source six step and PWM inverters are of 
the forced commutated type and this tends to restrict their 
ratings. Although developments in Gate Turn Off Thyristors 
(GTO’s) have, with PWM inverters, resulted in drives rated in 
Megawatts becoming available, it is necessary for the largest 
power drives to use line commutated inverters. 

There are two convertor types available, the synchro- 
convertor which can only be used with synchronous motors 


eo ( 


= ' 


and the cyclo-convertor which can be used to supply both 
induction and synchronous motors. The synchro-convertor 
is a de link type arrangement that is essentially the same as 
the de transmission system used for long distance power 
transmission. The cross channel dc link is rated for 2000MW, 
so it is likely that the arrangement will be able to cater for 
any likely power demands. The largest powers to date for 
drives have been at ISMW. 

As with any static convertor the ac output of a variable 
frequency inverter is rich in harmonics and this may cause 
problems with the motor. There are two noticeable effects, 
torque pulsations and additional heating. 

The six step inverter can be limited in its application 
because at low frequency there may be pronounced stepping 
effect on the rotation of the shaft. This is only an expression 
of the general problem of torque pulsations which on larger 
drives requires investigation because of the possibility of 
exciting shaft resonances. Conditions have arisen on indus- 
trial drives where there has been damage to the driven 
system because of the motor torque pulsations; flexible 
couplings, correctly selected, have proved to be a way of 
overcoming this difficulty. 

Additional heating is caused by increased losses due to 
harmonics in the supply waveform and reduced cooling at 
low speeds. Although there is some increase in core loss and 
stator copper loss the dominant additional loss is in the 
rotor. In addition to the increase in loss, the flow of cooling 
air around the machine is reduced as the speed falls. 
Manufacturers provide derating factors for their motors and 
these should be followed when any inverter drive uses stan- 
dard motors, as all of them do for small powers. 

Inverter fed motors in hazardous areas present a special 
problem because of the need to ensure that there is no exces- 
sive local heating. Exe motors are particularly troublesome 
in this respect and Exd motors are to be preferred. However 
it is essential that the motor has been certified for use with 
an inverter supply and such machines are available when 
protected by thermistors. 


11.0 COMPUTATION OF MACHINE FIELDS 
After a century of gradual evolution it might be expected that 
there was little scope for further improvements in electric 
machines, but this is not the case. The increasing use of power 
electronics to provide variable frequency supplies has required 
considerable effort to investigate the electromagnetic 
behaviour within the machine. Small motors for industrial and 
domestic drives are produced in very large numbers and 
economic pressures are forcing a continual assessment of the 
designs. 

Developments in materials have had significant affects and 
these are continuing, the present situation with regard to amor- 
phous magnetic steel for transformer laminations is only one 
example. 

An understanding of the electromagnetics involved within 
the machine is an essential part of the electrical design process 
and this has been helped by developments in numerical tech- 
niques. The finite-element method is now widely used for the 
computation of field problems within machines and for the 
evaluation of induced current effects in the structure of a 
machine. 

Mesh generation times have been significantly reduced by 
interactive graphical procedures and it is claimed a mesh can 
be created in two to three hours by an experienced operator. 
An example of a typical mesh and the machine flux pattern for 
one operating state in a two pole ac generator is illustrated 
(Fig. 24). 
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Fig. 24 Finite Element Mesh and Flux Distribution 


Electromagnetic problems in large two pole generators 
have been one of the main driving forces behind finite element 
techniques for electrical machine applications. There were 
some very serious problems with early 600M W size generators. 
Eddy current heating at the ends of the cores resulted in damage 
to the machines and there were rotor heating problems, again 
because of eddy current effects. 

For other machines it is necessary to balance the cost of the 
computation against the likely benefits in savings in materials 
or manufacturing costs that may result. In some instances deci- 
sions have been made that even for large motors the savings 
were not likely to justify the computation costs and standard 
design procedures were used. Unusual machine geometries, 
particularly with regard to reluctance type machines, are one 
area where detailed computation can be justified and is under- 
taken. 


12. CONCLUDING COMMENTS 


This paper has dealt with a number of topics related to electrical 
machines, the choice has been personal and reflects recent 
problems but it should not be considered to be exhaustive. The 
treatment of each topic has, of necessity, been brief but suffi- 
cient to highlight the fact that problems can be experienced. 
Subjects which have been excluded, such as parallel operation 
of ac generators, are also important and present problems but 
something has to be left out. 
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SYNOPSIS 


lhe investigation, completed in late 1990, into the Piper Alpha 
disaster of 1988 pioneered a shift away from state regulation 
toward personal responsibility and voluntary, self regulating 
effort on the part of installation owners and operators. Rather 
than simply complying with a list of prescriptive regulations, an 
operator will be required to submit a Safety Case for each instal- 
lation. This new offshore regulatory regime, involving the 
development and enforcement of regulations by the Health and 
Safety Executive, will establish the role of Quantitative Risk 
Assessment (QRA). It will complement the existing certifica- 
tion regime which will continue in a similar form for the 
foreseeable future. However within certification, owners or 
operators may be allowed to seek dispensation in respect of 
certain design features on the basis of a risk assessment. 

The new Safety Case legislation has been produced in the 
form of a ‘Consultative Document’ published mid-1992. After 
a consultation period, it is envisaged that the legislation will be 
enforced by early 1993. Owners or operators, as appropriate, 
may have until 1995 to complete the initial Safety Case on a 
given installation. 

ORA will be applied within a Technical Safety Assessment 
which, together with a review of safety management systems, 
will form the foundation of any Safety Case. This paper illus- 
trates, by discussion of selected aspects, the preparation of a 
Technical Safety Assessment for a hypothetical, existing, 
Mobile Drilling Unit (MODU). The general principles will be 
the same for all production and drilling units. Preparation of a 
Technical Safety Assessment for an existing unit may highlight 
areas of high risk which can be overcome by upgrade of hard- 
ware or equipment. Means to derive the benefits of hardware 
and equipment upgrades in terms of the reduction in potential 
loss of life, are described. Justification for recommended 
improvements can thus be made when the resultant benefits 
are weighed against their cost. The data herein are presented 
at a simplified level using elementary techniques intended for 
illustrative purposes only. 

The conclusions are intended to lead to discussion and do 
not represent any policy of the Safety Technology Department 
or of Lloyd’s Register. 


1. INTRODUCTION 
1.1 Overview 


Until recently, offshore legislation for the UK Continental Shelf 
was enforced by the Department of Energy (DEn). The key 
Statutory Instruments were and remain as follows: 


$1289 Construction and Survey 
SI611 Fire Fighting Equipment 
SI486 Life Saving Appliances. 


S1289 sets out the certification regulations under which 
Lloyd’s Register has been acting as a Certifying Authority since 
1974. The checking for compliance and survey of the items 
covered by SI486 and SI611 was delegated by the DEn to the 
Marine Department of the Department of Transport. A number 
of other statutory instruments cover more specialised aspects. 

The report of the public inquiry into the Piper Alpha disaster 
recommended, inter alia, a change in regulatory authority from 
the DEn to the Health & Safety Executive (HSE). Also recom- 
mended was the introduction and enforcement by the 
regulatory authority of ‘Safety Case’ regulations. These recom- 
mendations were accepted by the Government and either have 
been or are being implemented. 

The Safety Case regulations will be exercised in parallel with 
certification. The role of the Certifying Authority will be 
reviewed at some time in the future but until this review is 
complete certification will continue very much as before, 
although on certain design features, operators or owners may 
be allowed dispensation from $1289 on the basis of a risk assess- 
ment. The same holds in respect of $1611 and $1486, which are 
now enforced directly by the HSE. 

Anexcellent description of the certification regime has been 
given by Tindall [1]. 


1.2 The Quantitative Approach to Safety Assessment 


A concept central to the new UK offshore legislation, is that of 
self-determination on the part of rig owners, with accident 
prevention and mitigation systems based on the *ALARP? (risk 
levels As Low As Reasonably Practicable) principle. The 
correct adoption of the ALARP principle should be demon- 
strated within a Technical Safety Assessment, which will be one 
of the major constituents of the Safety Case, along with a review 
of safety management systems. Where major items of hardware 
and equipment are of concern, the Health and Safety Executive 
(HSE) will expect to see a cost-benefit analysis in the Safety 
Case particularly where: 
(a) Benefits in terms of the reduction in risk and loss of life 
are quantifiable, and 
(b) The level of proposed hardware and equipment does not 
meet generally accepted risk criteria. 


Quantification is to include, where appropriate, estimation 
of the frequency of major hazards and their consequences 
including estimates of the number of fatalities. The effects of 
risk reduction and mitigating measures can be included. By this 
means, the benefits of hardware upgrades can be weighed 
against the cost of the accidents which they are designed to 
prevent or mitigate. This is an iterative process illustrated in 
Fig 1. Where full quantification is not possible, a limited quan- 
tification may be appropriate. 

Improvements to safety management procedures 
(Appendix A) may offer the most cost-effective ways of reduc- 
ing risk. Hence management options may be exhausted before 
hardware or equipment upgrades are considered. However, a 
detailed discussion of safety management is outside the scope 
of the present paper. 


(1) Identify hazards 


(3) Estimate probability 


(4) Evaluate consequences 


(5) Identify those accident 
scenarios which may 
require evacuation 


(8) Evaluate risks posed 
by minor hazards 


(2) Establish control, suppression 
and mitigating measures 


(7) Evaluate potential 
loss of life (PLL) 


(6) Evacuation 
Analysis 


(9) Establish overall risk 


level for installation 


Fig. 1 Steps in Quantitative Risk Assessment 


The conclusions herein are intended to lead to discussion 
and do not represent any policy of Lloyd’s Register or of the 
Safety Technology Department (LRSTD). 

The limitations of QRA must at all times be recognised. No 
claim is made that the methods described would lead to accu- 
rate estimates of fatalities in any given incident. However the 
assumptions made and techniques used enable different 
degrees of protection to be evaluated, on a comparative basis. 


1.3 Description of the New Regulatory Regime 


1.3.1 Legislative Framework 


The Draft Offshore Installations Regulations [2] (the ‘draft 
regulations’) embody the ‘goal setting’ approach adopted by 
the HSE. By this approach, operators and owners will be 
required to set their own standards on safety, and to prove by 
audit, ORA or other means, that those standards are met. This 
applies to both hardware and safety management aspects. The 
draft regulations are written in the form of a limited number 
of regulations, fifteen in all, some of which are supported by 
schedules. These in turn are supported by non-mandatory 
guidelines. 

It must be stressed that the draft regulations are under 
discussion and are likely to change before being enacted. 

The draft regulations make no stipulation on the provision 
of hardware or systems. However, the HSE envisage publishing 
separate legislation, replacing existing Statutory Instruments, 
on the following (p38 of [2]): 

— construction 

~ plant and equipment 

~ fire and explosion protection 

— evacuation, escape and rescue. 


Together with the existing certification regime which will 
continue for the foreseeable future, this legislation will comple- 
ment the Offshore Installations Regulations. 
The only acceptance criteria cited by the draft regulations 
are the following: 
—endurance time for the Temporary Safe Refuge (TSR) 
should be a minimum of one hour; 
— the risk of a breach of the TSR during this period should 
be ALARP and no greater than 1.0 x 10-/yr. 


These criteria may be superseded in future depending on the 
accessibility of other targets. Some installations may be exempt 
from the requirement for a TSR under certain, probably excep- 
tional, circumstances. 

Mobile installations will be required to have a Safety Case 
prepared for submission by November 1993. There will then be 
a two year breathing space for those recommendations derived 
from the Safety Case, to be implemented. For installations 
initially outside UK waters, the Safety Case must be first 
submitted at least six months before it is intended to move the 
unit there. The draft regulations do not address the transit 
phase of a mobile installation, nor rescue operations by heli- 
copter or standby vessel. 

Periodic updating of the Safety Case will be required at 
intervals of three years or longer, or when modifications to 
hardware or management systems are carried out that may 
render the Safety Case materially different from the version 
previously accepted. 


1.3.2 Types of Hazard 


Essentially, all accident types must be considered. The following 
list which the HSE do not intend to be exhaustive, has been 
extracted from p193 of [2]: 
hydrocarbon escapes. leading possibly to fire, explosion, gas 
ingress to Sensitive areas, or toxic hazards; arising from wells, 
processing equipment, fuel supply systems, import and export 
pipelines and any other pipework systems, storage, blowdown 
systems etc: 
vessel impact, including support vessels, supply vessels, rigs, 
associated activities (diving, etc), simultaneous operations rigs, 
field traffic, through traffic, military activities, fishing, loose 
single-point mooring-buoys, bulk oil transports: 
structural failure, including effects of corrosion, fatigue, foun- 
dation, extreme weather, extreme seas, overloading, seismic 
effects, ice accumulation; 
aircraft impact, including visiting helicopters, passing heli- 
copters, fixed-wing civil and military aircraft; 
dropped loads, dropped objects: 
fire, including fires in accommodation, electrical fires, heli- 
copter fuel, hot work, oxygen enrichment; 
for mobile and floating units: loss of station-keeping, loss of 
stability, loss of buoyancy; 
effects from nearby installations particularly those linked by 
pipelines, including undersea releases, oil slicks, fire and explo- 
sion effects, impact: 
specific hazardous activities, including diving, construction 
work eg. scaffolding collapse, heavy lifts, pipeline pigging, emer- 
gency exercises (which may themselves create extra hazards). 


Itis stated that particular attention should be paid to small fire and 
explosion events which might escalate to threaten the TSR, or 
which might damage active and passive fire protection systems. 


1.4 Application to Existing Mobile Drilling Units 


The most significant hazard to MODUs, in terms of both the 
number of fatalities and the frequency, is blowout (although this 
is not the most likely incident to cause total loss of the unit). Older 
MODUs were designed without appropriate cognisance of the 
impact of major fires and explosions on accommodation, muster 
areas, escape routes and evacuation facilities. Whilst measures can 
be taken to reduce the loss of life and other undesirable conse- 
quences to tolerable levels within the bounds of acceptable cost, 
the options are often limited by the inherent configuration of the 
installation. Examples of systems or facilities which may be evalu- 
ated in terms of the loss of life include the following, which is not 
an exhaustive list: 
~ Passive fire and explosion protection to spaces which may 
serve asa TSR. 
~ Passive fire and explosion protection to muster stations and 
‘additional refuges’. 
— Additional or improved evacuation facilities. 
— Explosion mitigation. 
~ Certain emergency systems. 


This paper illustrates the evaluation of the Potential Loss of Life 
(PLL) for selected hardware upgrades to mitigate major fires and 
explosions on a typical installation. An illustration is thereby 
provided of techniques to establish the requisite level of hardware 
upgrades on the basis of aiming for a risk “As Low as Reasonably 
Practicable’. The PLL is defined simply as the estimated loss of life 
per unit time or per operational phase. 

The mitigation of fire and explosion hazards for which quan- 
tification is either more limited or not feasible, will be equally 
important to the development of a Technical Safety Assessment. 
Such hazards may include fires in storage spaces or electrical equip- 
ment. The systematic evaluation of these hazards is not discussed 
at depth in the present paper. 
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2. METHODOLOGY OF A TECHNICAL 
SAFETY ASSESSMENT 


The methodology to be adopted in a Technical Safety 
Assessment will be described in relation to Fig. 1. 


2.1 Identification of Hazards 


The Technical Safety Assessment must demonstrate thata thor- 
ough and systematic approach has been taken to identify 
accidents which could result in injury to personnel or significant 
damage to the installation. For each hazard the systems and 
equipment installed to respond to and mitigate the effects of 
the accident should be identified. The favoured technique for 
drilling units is Failure Mode and Effects Analysis (FMEA). 
The alternative technique, Hazard and Operability Studies 
(HAZOP), is favoured for production units. However a form 
of HAZOP using modified guidewords could be applied to 
drilling units. 

Most hazards with severe consequences will involve a 
release of flammable fluid with the possibility of fire or explo- 


sion. However, all credible accident scenarios must be 
considered. 

Typical hazards can be categorised as follows: 

— blowout 


~ other well related fire and explosion including mud and 
completion fluids 

— other causes of fire, for instance electrical equipment 

—impact and collision involving both ships and helicopters 

— loss of stability 

— station holding failure 

— dropped objects 

— structural failure 

— toxic or radioactive release 

— extreme weather conditions. 


It is possible that several hazardous events may occur simulta- 
neously or sequentially as a result of escalation hence relevant 
combinations will need to be identified and the consequences 
considered as for single events. 

The most severe hazards will be those which affect the 
integrity of the TSR. Options for the layout and protection to 
be afforded to the TSR should be evaluated using the iterative 
scheme demonstrated in Fig. 1. This should include a smoke 
and gas ingress study. 

FMEA is a qualitative technique intended to identify fail- 
ures which have significant consequences affecting the safety 
or operation of the unit. Itis a means of ‘systematic brainstorm- 
ing’ whereby the unit is considered on an individual area, 
system or activity basis. Each part of the unit is then investigated 
for failure modes and causes. The effects of failure, together 
with mitigating or eliminating factors, are then listed. Detailed 
discussion and analyses of each part of the unit can then take 
place when the FMEA is over, signalling the end of the hazard 
identification exercise. 

The analysis can be applied at any stage of the design or 
review. It is particularly appropriate when a design or opera- 
tional review is taking place. Requirements for improved 
systems can then be measured against existing systems and miti- 
gating measures. 

In the framework of most offshore Technical Safety 
Assessments, the failure consequences are assessed with 
regards to the effects on the integrity of: 


i) 


emergency systems 
accommodation 
control centres 
evacuation systems. 
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Any failure mode which has a significant probability of impair- 
ing any of the functions above is then subject to a closer scrutiny 
with the aim of reducing the frequency and/or the consequences 
of such a failure. 

This notwithstanding, any failure mode which discloses a 
safety hazard, defined as a failure which threatens human life 
or poses a threat of high material damage, is considered in order 
to ensure that its probability is sufficiently low. 

When assessing the potential damage, particular attention 
is paid to any active protection and monitoring systems. 

The failure mode is considered primarily with respect to the 
understood major accident hazard types, for example, fire and 
explosion, together with other initiating events which may 
affect emergency systems. However, recognising that these 
reflect the high consequence contribution to risks, attention is 
also paid to the lesser hazards which may have a cumulative 
contribution, where appropriate. 


2.2 Control, Suppression and Mitigating Measures 


Management and hardware control systems should be 
described in advance of the hazard identification to which they 
will form a necessary input. Having derived the PLL for major 
accidents (step 7 of Fig 1), management issues may be exhaus- 
tively reviewed before consideration is given to hardware 
aspects. The Technical Safety Assessment will analyse hard- 
ware control and suppression systems to ensure that they are 
adequately protected and that they are able to survive accident 
events. It should be demonstrated that having survived these 
events, the systems are reliable in performing the functions for 
which they are intended. The emergency systems to be consid- 
ered include the following which may not be an exhaustive list: 

— emergency shutdown 

— isolation and venting 

— passive fire protection 

— blowout preventers 

~ diverters 

— emergency power supplies 

— emergency communications 

~ fire and gas detection and alarm 

~ deluge. 


Should the risk of a major accident exceed pre-determined 
criteria, the effects of additional prevention measures will be 
evaluated. Where these are not practicable, additional control 
or mitigating measures should be considered. 


2.3 Probability Assessment 


Estimates for the probabilities of major accident events may 
be based on information from published sources or from 
databases. LRSTD hasat its disposal both a variety of databases 
on equipment failure rates and statistically treated historical 
data on major incidents. Where necessary, the likelihood of 
major failures which may originate from more than one equip- 
ment failure or originating incident should be evaluated using 
fault tree analysis. Event tree analysis may be used to estimate 
the probability that various consequences will arise from a 
given failure. 

Many minor accidents are also amenable to failure rate or 
statistical analysis and where appropriate, these techniques will 
be used to estimate their cumulative effect. 
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2.4 Consequence Analysis 


Consequence analysis should be carried out using codes which 


model the following accident types: 

~ pressurised release of gas and liquid, single or two phase, 
including the effects of flow resistance through pipe 
networks 

— jet fire 

— pool fire 

— gas dispersion, both partially confined and unconfined 

— unconfined vapour cloud explosion 

— partially confined explosion 


The likelihood of escalation can be established using the explo- 
sion models and other models for missile generation and 
impact, and heat transfer to and within process and other equip- 
ment. 


2.5 Escape and Evacuation 


The success rate of evacuation makes an important contribu- 
tion to the PLL. The following factors which are essential for 
safe evacuation should be investigated: 
— accident detection and alarm systems 
— escape route integrity under accident conditions 
— viability and accessibility of evacuation systems under 
accident conditions 
—integrity of the accommodation and TSR, particularly 
against fire and smoke ingress 
~ integrity of control centres. 


Safety management aspects such as evacuation drills and 
command structure are also important. 


2.6 Potential Loss of Life 


The PLL, together with the probability of the accident itself, is 
a crucial figure in the *‘ALARP’ process. Should any event be 
shown to have a high PLL, additional accident prevention or 
mitigation methods should be evaluated. 

It must be emphasised that the PLL, as with other measures 
of risk, should be utilised only to compare design or hardware 
options in terms of cost/benefit aspects. If used as an absolute 
measure of risk, it should be addressed with caution. 


2.7 Evaluation of Minor Hazards 


As noted in Section 2.3, the likelihood of certain minor hazards 
can be estimated. Minor hazards identified in the FMEA will 
be investigated to ensure that sufficient preventive measures 
exist and that the likelihood of escalation is minimised, again 
based on the ‘ALARP’ principle. 


2.8 Overall Risk Level 


The Technical Safety Assessment could culminate in an esti- 
mate of the overall risk level for the installation. However the 
overall risk level will not be seen by the HSE as the sole measure 
of the acceptability of the Safety Case. Whilst the HSE have 
yet to disclose how Safety Cases will be accepted, it is likely 
that they will be judged in comparison with current standards 
taking into account the measures taken to reduce risk. 


3. EXAMPLE OF QUANTITATIVE RISK 
ASSESSMENT; EVALUATION OF THE 
BENEFIT OF HARDWARE UPGRADES TO 
MITIGATE BLOWOUT 


al General Comments 


In this section, the application of QRA is illustrated by 
means of analysing the benefits of (a) the addition of anti- 
fire and anti-blast barriers and (b) improvement of certain 
other emergency systems on a typical, hypothetical MODU. 

The likelihood of blowout is perhaps one order of magni- 
tude higher on a MODU than on a fixed production 
platform. Only about one-third of offshore blowouts ignite. 
However, those that do, and many of those that do not, have 
catastrophic consequences. 

The most versatile tool in judging the benefit of hardware 
upgrades to mitigate blowout is the PLL. This is defined in 
the present example, simply as the estimated number of 
fatalities per unit year. The owner or operator can use these 
data in a cost-benefit analysis to decide whether an upgrade 
should be implemented. The regulatory authority may 
require an explanation of the costings involved, to ensure 
that risk criteria on the principle of “ALARP’ have been 
appropriately applied. The owner or operator may take into 
account other criteria, such as projected loss of income due 
to a blowout incident, which would raise the acceptable cost 
threshold. 

On the hypothetical MODU within the present discus- 
sion, the following upgrades are quantified: 

degree of fire and blast protection to the TSR and ‘addi- 

tional refuges’ 

centralised control of emergency mooring disconnect 

relocation of the ballast control function to the TSR 

various upgrades to escape and evacuation facilities. 


spaces 
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3.2 Brief Description of Hypothetical Unit 


The hypothetical unit selected is a propulsion-assisted semi- 
submersible drilling unit (Fig 2). The unit has an octagonal 
configuration with approximate dimensions of 100m both 
forward to aft and port to starboard. The drill floor is central, 
with the cellar deck and moonpool beneath. The quarters are 
on the port side. 

Most drilling emergency functions can be controlled from 
three places, the rig office within the quarters, the drillers 
control room on the drill floor and a separate hydraulic control 
room. Any further consolidation of control functions would be 
centred on the present rig office, within the quarters. Ballasting 
is controlled from a separate ballast control room on top of one 
of the columns remote from the quarters. 

The unit has an eight-point mooring system, with four local 
windlass control stations on corners of the unit, each providing 
tension control of two chains. 

The quarters consists of two levels, each level having a view 
of the drill floor. The TSR would almost certainly be adapted 
from the present quarters. 


3.3 Fire and Blast Protection to the Temporary Safe Refuge 


The TSR should have sufficient endurance against fire and 
explosion to allow personnel to muster and evacuate. It is 
assumed that the hypothetical MODU has no rated fire or 
blast barriers to the TSR. Blast Barriers and H120 fire barriers 
must be added to at least the Inward Facing Elevation (IFE), 
unless a risk analysis shows a lower grade of barrier to be 
acceptable. 

H120 is the most durable grade of standard firewall. The 
durabilities of the various grades of firewall are defined by stan- 
dard (cellulosic) and hydrocarbon fire tests, and are given in a 
number of sources, for instance [3]. Firewalls may be pene- 
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Fig. 2 Schematic Plan of Hypothetical MODU 


trated in shorter times by severe fires than their grade would 
suggest. An example of actual penetration times is given in 
Table 1 [4]. 


Table 1 - Time to failure of firewalls or steel structures 


Time to failure (minutes) 
(Burn-through or loss of load-bearing capacity) 


Jet fire | 37.5kW/me" | Pool fire | 37.5kW/m2* 
from pool fire 


flame from jet fire flame 


120 


Unprotected 
structural steel 
beam (load-bearing) 
Unprotected 


steel plate 
(non- oR: -bearing) 


A6O (H) Firewall 
H120 Firewall 60 120 


| 30_| 
| 60 | 
| 120 _| 
Protected 
15 30 
| 10 | 
| 30_| 


15 


structural 
riser | tO | 20 | 10 
: OMG Mr 


*37.5kW/m2 is an often-quoted critical heat flux 


A range of fire barriers must be evaluated in order to demon- 
strate that the risk is ALARP. Fire protection need be applied 
essentially only to the IFE and roof. Owners usually ‘wrap 
around’ passive fire protection to cover a small proportion of 
the adjacent elevations. 

Blast analysis has shown that in areas of fairly high conges- 
tion such as that inboard of the TSR on the present installation, 
overpressures of 0.2 bar may be generated by an Unconfined 
Vapour Cloud Explosion (UVCE). The necessary disposition 
of this blast protection must be considered. Owing to the indis- 
criminate nature of a UVCE, more surfaces may require blast 
protection than require fire protection. In the present case, 
blast protection should be considered for the fwd and aft eleva- 
tions of the TSR but need not be considered for the port 
elevation which will be in the lee of any blast wave. 

Blast protection to the floor of the TSR need not be inves- 
tigated. Most deck structures are judged to withstand 
overpressures approaching 0.5 bar. 


Table 2 - Proposals for fire and ballast protection to TSR 


= Fire Protection Blast Protection 


None 
AGO on IFE and roof None 


A60 on IFE on roof On IFE and roof 
H120 on IFE and root 
H120 on IFE and roof On IFE and roof 


A60 on IFE and roof Each elevation and roof 
(excluding port elevation) 
H120 on IFE on roof Each elevation and roof 
(excluding port elevation) 
CERG Blastwalls do not retain stated fire resistance after blast 
C’ .E’ F’ ,G’ | Blastwalls retain stated fire resistance after blast 


IFE = Inward Facing Elevation 


The cases listed in Table 2 will be evaluated. These 
describe eleven relevant combinations of fire and blast 
protection, beginning with case ‘A’ (no rated firewalls or 
blastwalls) through to case G (H120 fire protection on IFE 
and roof, and blast protection on each elevation and roof, 


excluding the port elevation). Cases C.E,F,G involving both 
fire and blast protection, assume that the blastwalls do not 
retain their stated fire resistance after blast. These are 
compared with cases C’,E’,F’,G’ in which the blastwalls do 
retain their stated fire resistance after blast. 


3.4 Results and Conclusions 


A simplified model which demonstrates the evaluation of 
the PLL for each of the above cases is given in Appendix B. 
Results are listed in Table 3. 

The benefits of the fire walls and blastwalls are not as 
great as might be expected. Certainly the improvements to 
the TSR have a lower impact than would be expected on a 
production installation, particularly one being newly 
designed. A new design would take into account the position 
of the TSR and access to it based on the most likely fire and 
explosion scenarios. The low impact of the improvements 
discussed in respect of the present hypothetical configura- 
tion, is seen to have two main causes: 

~ the main risk is due to blowout rather than process fire, 

and an ignited blowout may have catastrophic, uncon- 
trollable consequences regardless of the degree of 
protection afforded to the TSR. Whilst many process 
fires could be ‘sat out’, an ignited blowout could ulti- 
mately destroy the TSR regardless of its protection. 

—a blowout may render some or all escape ways to the 

TSR unusable, since the TSR is isolated on one side of 
the installation and the layout and configuration does 
not allow easy access to it. This may be counterbalanced 
by the presence of lifeboat stations (for which protection 
against fire and blast may be recommended) elsewhere 
in the installation, however the degree of protection 
afforded to the TSR may be immaterial to many person- 
nel outside it at the initiation of the accident. 


3.5 Examples of Other Quantifiable Aspects 


3.5.1 Control Functions within the Temporary Safe 
Refuge 


The Public Enquiry into the Piper Alpha Disaster [5], led by 
the Hon. Lord Cullen, stated that: 

“The TSR should prove a place where persons can remain 
whilst either the situation is brought under control or a safe 
evacuation is organised. It should enable monitoring of acci- 
dent conditions and the exercising of some degree of control 
over them”. 

In addition to the safe haven function, Cullen recognised 
three different control spaces for the TSR: 

— radio room 

— control room 

— emergency command centre. 


But Cullen made *... no proposals on the precise nature of 
the minimum facilities which should be made available 
within the TSR...’, however, it would be recommended that 
on most mobile installations, they should include the follow- 
ing: 

~ fire and gas detection 

~ fire fighting control 

— alarm 

— communication both internal and external 

~ well control 

— emergency riser disconnect 

— emergency mooring disconnect 

— emergency power 

— ballast control 


Table 3 - Estimated potential loss of life due to blowout 


It is usual for existing MODUs to have most of the above emer- 
gency functions already present within the TSR, with the 
exception, in many cases, of emergency power, some aspects of 
fire-fighting control, emergency mooring disconnect and 
ballast control. Itis acceptable for these to be located separately 
if given the equivalent degree of protection. 

It is considered that in the cases of mooring disconnect and 
ballast control on existing MODUs, if these are not already 
present within the intended TSR, their relocation to the TSR 
may be decided on the basis of a judgment of the benefits 
against the costs. 


3.5.1.1 Centralised Control of Emergency Mooring 
Disconnect 


Ona propulsion-assisted or self-propelled MODU, the anchor 
release system is considered an emergency system since a 
subsea blowout will create a demand for moving rapidly off- 
station. This is the only incident that is capable of creating a 
demand for rapid movement whilst also threatening the 
system. 

Newly built semi-submersibles will almost invariably have 
centralised control of emergency mooring disconnect. 
However, older units may not. Instead, disconnection would be 
controlled locally at the windlass stations. The present hypo- 
thetical MODU is assumed to have four windlass control 
stations, each controlling two windlasses. Moving off-station in 
an emergency is achieved by releasing the tension in the wind- 
lasses on one side of the unit and allowing the tension in the 
remaining windlasses to pull the unit away. Propulsion power 
is not required, hence propulsion is not considered an emer- 
gency system. 

On installations similar to the present one, emergency 
mooring disconnect and pulling away to a safe location can be 
achieved, without propulsion power, in approximately 
15 minutes under ideal conditions during a drill. It is assumed 
that the unit is equipped with a windlass water spray which will 
quench sparks during paying-out of the anchor chains. 

The benefit of a protected, central control station for emer- 
gency disconnect is dependent on the relative time taken to 
pull off station either centrally or by local control of the wind- 
lasses, and the effect of this time difference on the probability 
of ignition. The probability of ignition of asubsea blowout used 
in the event tree analysis of Appendix C, ie. 0.3, is necessarily 
for ‘delayed’ ignition. That is, ignition will invariably be 
‘delayed’ - ie. occurring at a time long enough to lead to a large 
accumulation of gas and a UVCE - owing to the large distance 
between the source of the gas and any ignition source. The 
problem is one of estimating ‘how delayed’. 

It is likely that shutdown of non-essential systems would be 
achieved promptly after gas detection. The probability of igni- 
tion would be tniform with time thereafter. If this is the case 
for the blowout incidents on which the historical data are based, 
then it may be assumed that 30% of all historical subsea 
blowouts ignited at some time between the release of gas and 
the minimisation of activity on the installation sufficient to 
avoid ignition (ie. evacuation and complete shutdown), which 
is taken to be one hour. It is further assumed that emergency 
mooring disconnect, and pulling away to a reasonable distance, 
could be achieved within 15 minutes if done centrally from 
within the TSR. If the operation had to be carried out locally, 
personnel would have to be briefed and organised. They would 
have to make their way to the local control stations and establish 


VHF communications with the Offshore Installation Manager 
(OIM), at a time when other emergency functions are being 
carried out. It is assumed that emergency mooring disconnect 
under these conditions would take about 45 minutes. The extra 
half hour remaining on-station would allow about 15% of 
subsea blowouts to ignite. 

This 15% is obtained from only a cursory examination of 
the situation, for the purposes of the present illustration. A 
rigorous analysis would include human factors, gas dispersion 
calculations and fault-tree analysis. Nevertheless, continuing 
with the 15% figure, the PLL model of Appendix B has been 
re-run. It is found that by creation of a central control station 
for emergency mooring disconnect, then for Case A (no rated 
firewalls or blastwalls to the TSR), the PLL is reduced from 
9.5 x 103 to 8.7 x 10-3 per year. 

It should be emphasised that management procedures will 
have a significant affect on emergency disconnect, as well as on 
blowout response generally. These aspects have not been 
considered herein. 


3.5.1.2 Relocation of Ballast Control Function 


The benefits of either the present location or a new location 
within the TSR are discussed qualitatively below with respect 
to the accident scenarios which may require the ballast system 
to be active. 


Blowout Related Fire/Explosion 


Control links between the TSR and ballast pumps/valves would 
likely be destroyed before serious structural damage occurred, 
reducing the effectiveness of a ballast control station within the 
TSR. Location of the control station as presently configured 
would make control links less vulnerable. 

The most important factor is that an ignited blowout event 
would necessitate rapid evacuation and reliance would be placed 
upon the failsafe valve operation. Itis probable that ballast control 
would neither be required nor attempted. Personnel within the 
ballast control space may evacuate to sea level. The position of 
the ballast control room at perhaps 40m from the centre of a 
topsides fire, means that passive protection to the space would 
be desirable but in view of other factors, not essential. 


Non-Blowout Related Fire/Explosion 


Non-blowout related hydrocarbon fires would not disrupt the 
ballast control station at its present, remote location. 


Loss of Stability Events 


It is not considered that ballast control during stability impair- 
ment could be significantly improved if exercised from the TSR. 
The simultaneous occurrence of stability impairment and major 
fire is of insufficient likelihood to necessitate exercise of control 
from the TSR. 

As discussed above, relocation of the ballast control func- 
tion to the TSR has no substantial benefit in terms of accident 
mitigation. The only factor that needs to be considered is the 
higher PLL of the present configuration due to the vulnerability 
of the personnel in the ballast control room. 

During a topsides jet fire, personnel present within the space 
will evacuate to sea level, muster stations being inaccessible to 
them. During subsea blowout events they will be able to reach 


the TSR and during topsides blowout events not involving jet 
fire, they will be able to reach muster stations outside the TSR. 
It is assumed pessimistically that two people are initially present 
in the space. 

With the above assumptions, the PLL model of Appendix B 
has been re-run. It is found that if the ballast control function 
is relocated to the TSR, then for Case A (no rated firewalls or 
blastwalls to the TSR), the PLL is reduced by only 1.1 x 10° 
per unit year. 


3.5.2 Escape, Evacuation and Rescue 


In most serious accidents, few people are killed in the initial 
incident. Fatalities may follow as conditions on the unit dete- 
riorate and evacuation to the sea itself can be hazardous, 
particularly if done hurriedly and the evacuation facilities are 
affected by the accident conditions, for instance thermal radi- 
ation or tilt of the unit. 

An ‘escape and evacuation analysis’ should be carried out 
as an integral part of a QRA. The objective is to ensure that 
sufficient escape and evacuation facilities of sufficient quality 
exist to minimise loss of life. This should be done by consider- 
ation of the effects of each major accident in turn. This approach 
will invariably demonstrate shortcomings in escape and evac- 
uation systems which would not be evident by a simple 
‘checklist’ type approach of matching the capacity of the evac- 
uation facilities to the number of personnel on board. 

By convention ‘escape’ means escape from the accident to 
muster stations. ‘Evacuation’ is the process of leaving the instal- 
lation via the sea or helicopter. ‘Rescue’ means retrieval from 
the sea. 

An FMEA ona unit similar to the present hypothetical unit 
identified ten particular scenarios that could threaten the evac- 
uation facilities or more specifically the muster stations. 

These scenarios were: 


(i) Blowout from drillfloor 

(ii) Blowout from cellar deck 

(iii) Subsea blowout 

(iv) Release of hydrocarbon in mud house 

(v) — Release of hydrocarbon from welltest equipment 
(vi) Fire in machinery house 

(vii) Pool fire on helideck or helicopter crash 

(viii) Release of hydrocarbon from drillfloor 

(ix) Release of hydrocarbon from cellar deck 

(x) Release of hydrocarbon from columns. 


3.5.2.1 Escape Routes 


The FMEA process should consider the viability of escape 
routes from each area under the circumstances envisaged 
during the scenarios identified. Thus, escape routes that could 
become unviable will be identified. In order to assess the impor- 
tance of unviable escape routes, two main criteria should be 
considered: 

a. Whether an alternative escape route would remain viable. 
b. Whether any area where escape is considered impossible 

is likely to be manned. 


On the hypothetical installation, it is envisaged that escape 
routes from the following three areas may require further atten- 
tion: 

~ BOP handling room (on cellar deck) 

— Cellar deck main area 

~ Ballast control room 


Manning levels in the BOP handling room are low and this area 
need not be considered further. Personnel present in the cellar 
deck and ballast control room would have to evacuate directly 
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to sea level during an ignited blowout, muster stations being 
inaccessible to them. It would have to be ensured, therefore, 
that personnel survival equipment, i.e. lifejacket and survival 
suit, be provided in these spaces for all personnel who may be 
present. 

Furthermore, escape from the ballast control room is via an 
existing portlight and escape ladder running down the side of 
the leg. It would have to be ensured that the portlight is of suffi- 
cient size. 


3.5.2.2 Muster Stations 


It would be recommended that the four muster stations on each 
side of the installation should remain, consistent with the shape 
of the installation and the intrinsic path of the escapeways. 
However, the three muster stations outside the TSR will be 
prone to fire, smoke and explosion (blast and missile) effects. 
Although it may be recommended that muster stations be 
protected from these effects, it may also be recommended that 
there should be sufficient lifeboat capacity on the port side adja- 
cent to the TSR for all crew in the event that the other 
escapeways become impaired after crew have sheltered in the 
TSR. This will enable the TSR to fulfil its desired role, whilst 
the other three muster stations may be required by personnel 
unable to reach the TSR. A ‘protected (muster) area’ in the lee 
of the accommodation and sheltered from the fire hazard is 
specifically recommended in the Cullen Report as are ‘addi- 
tional refuges’ outside the TSR. Radiation screens and 
blastwalls should be capable of withstanding estimated radia- 
tion levels and blast overpressures. 


3.5.2.3 Personnel Survival Equipment 


The most important personnel survival equipment are lifejack- 
ets, survival suits and smoke hoods. Of these three, only 
lifejackets are currently mandatory, although the Department 
of Energy expect to make the provision of survival suits manda- 
tory once certain practical difficulties concerning the wearing 
of lifejackets with survival suits have been overcome. 

It is common for lifejackets and survival suits for all 
personnel to be stored in their quarters. It is often found that 
the number stored at muster stations are only a proportion 
of the lifeboat capacity. Consideration may have to be given 
to increasing this proportion on some installations since 
during a hasty evacuation, many will be forgotten by the evac- 
uees. This could be the subject of an escape and evacuation 
analysis. 

Recommendations for additional lifejackets and survival 
suits should also be derived from a scenario-based evacuation 
analysis, as demonstrated above. Deployment of this survival 
equipment, additional to that recommended for the TSR and 
muster stations, is necessary for use by personnel who can reach 
neither the TSR nor a muster station, and who would perish if 
they could not gain entry to the sea. 

Breathing apparatus sets should be located at points around 
the installation consistent with manning levels. Sets which 
supply air are superior to smoke hoods which merely filter out 
particulates and allow toxic levels in the breathed gas to 
increase. 


4. DISCUSSION AND CONCLUSIONS 


An example has been given in Sections 3.1 to 3.4 of the tech- 
niques applied to evaluate the cost, in terms of loss of life, of a 
major accident involving fire and explosion. The example 


addressed the benefits in terms of the reduction in loss of life, * 


of various fire and explosion mitigation measures. 


As noted previously, the ALARP process implies a cost- 
benefit analysis. Using the above example, this may be 
concluded in the following manner. 

On the basis of the value of a human life being £1 x 106 (a 
purely hypothetical figure), the justifiable cost of upgrading to 
Case G’ would be about £0.11 x 10° if it were assumed that the 
remaining life of the installation is 10 years. The company may 
also apply other criteria, such as replacement costs, loss of 
income, and ‘intangibles’ such as the affect on its reputation. 

The example represents what is considered a reasonable 
interpretation of the HSE’s requirements within a Safety Case, 
for a cost-benefit analysis of quantifiable measures to reduce 
risk. It also represents the kind of procedure that an owner or 
operator should address in order to apply for dispensation 
within SI 289. For instance, the Guidance Notes to SI 289 
require that H120 divisions exist between accommodation 
areas and areas containing large quantities of hydrocarbon 
fluid. The installation of H120 divisions has financial and some- 
times, weight penalties. An owner or operator may therefore 
wish to demonstrate that a lower grade division, for instance 
A60, is acceptable. The extent of quantification may in fact, be 
less than that described in the example. It could involve merely 
demonstrating that a fire could not have a serious affect on the 
accommodation or that the probability is extremely low. 

Further, less detailed examples have been given in Sections 
3.5 and 3.6 of the benefits of the relocation of certain emergency 
functions, and of the type of quantification involved in escape 
and evacuation. These reflect the key thread of the Public 
Enquiry [5], and general consensus that quantification is more 
readily applied to fire and explosion accidents, escape and evac- 
uation, and emergency systems, than to other accidental events 
or systems. 
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APPENDIX A 
ASPECTS OF SAFETY MANAGEMENT TO BE 
INCLUDED IN A SAFETY CASE 


he process of identifying and providing countermeasures to 
hazards is essenual to safety management. There are four main 
aspects to be considered in evaluating the fitness for purpose 
as part of a safety management policy. These are: 

Organisation 

Management Implementation plan 

Competence 

Systems of Control. 


The organisation responsible for the operation and safety must 
provide a suitable management structure, typically involving a 
central office providing administration and support for opera- 
tion of the installation. This management structure must create 
a formal safety management system and be active in promoting, 
adapting, operating and maintaining that system. 

The central organisation should demonstrate a management 
implementation plan which ensures a comprehensive manage- 
ment system for operation of the installations which will 
function remotely and largely independently under a poten- 
tially wide range of circumstances. Auditing the safety 
management system thus calls for an appreciation of these 
operational influences and needs to cover both the central 
management aspects as well as the management of individual 
units. 

Competence in operations must extend to the safety func- 
tion expressed in the safety management system. Aspects such 
as training, qualification, experience and continuity of service 
for personnel are key factors in upholding and maintaining 
safety levels. 

Systems of control which may well extend beyond the imme- 
diate requirements of statutory provision, are required to 
ensure that appropriate operational methods and techniques 
are applied. Work instructions may incorporate, where rele- 
vant, checklists tailored to the specific operations being carried 
out. As operational requirements change, these instructions 
must be adapted and maintained. 


APPENDIX B 
ESTIMATION OF POTENTIAL LOSS OF LIFE 
DUE TO BLOWOUT 


B1 Basic Data 


B1.1 Likelihood of Blowout 


For the present hypothetical example, a blowout frequency of 
9 x 103 per unit year (assuming typical drilling deployment) is 
assumed (Appendix C). Detailed discussion of the likelihood 
and consequences of blowout is outside the scope of the present 
paper. 


B1.2 Consequences of Blowout 


Blowouts tend to release large quantities of gas and/or oil. Flow 
is dependent on reservoir pressure, the resistance in the well 
bore, and the type of failure. LRSTD data give an upper gas 
discharge rate of 60 kg/s. The largest credible flowrate of oil 
from a single well is through 9 %” unconstricted casing, and has 
been calculated as 170 kg/s. Gas and oil discharge rates for a 
subsea blowout will be on average, only slightly lower than 
those for a topsides blowout. 


B1.2.1 Jet Fire 


A jet fire will follow ignition of a gas blowout (the jet fire will 
be preceded by a UCVE if ignition is ‘delayed’ rather than 
‘immediate’). Owing to the high momentum of the jet, the flame 
will be little affected by even a strong wind. Should the flame 
be horizontal it will extend to a distance overboard the plat- 
form. A vertical flame will travel a similar distance upwards. A 
topsides blowout discharge may initially be oriented horizon- 
tally. However it will rapidly erode any obstruction causing it 
to flow horizontally and will adopt a vertical path. 


The following jet fire parameters have been derived: 


Flame length 67m 
Flame diameter 13m 
Maximum flux 280k W/m2 
Distance from flame axis to flux 26m 
of 37.5kW/m2 (corresponding to failure of 
unprotected load bearing structural steel 
within 20 min) 
Distance from flame axis to flux 34m 
of 11kW/m2 (corresponding to third 
degree burns, assumed to lead to instant 
fatality) 
Distance from flame axis to flux 42m 


of 4kW/m2 (corresponding to impairment 
of escapeways) 


Whilst longer flame lengths may exist at higher discharge rates, 
the horizontal radiation envelope will be very similar. 


B1.2.2 Unconfined Explosion 


The mass of gas discharged by a blowout is very large, and the 
momentum of the discharge is sufficient that the plume will 
extend downwind well overboard the platform before dispers- 
ing to beneath the Lower Flammable Limit (LFL). Should 
ignition take place after a large amount of gas has accumulated, 
the ignition will be termed ‘delayed ignition’ and a UVCE will 
result. Flames will burn back to the source of the discharge, 
leading to a jet fire. Ignition can take place only when the gas 


concentration is between the LFL and the Upper Flammable 
Limit (UFL) (these limits are 5% and 15% by volume, respec- 
tively, for methane). 

Unconfined explosions of methane do not develop high 
overpressures due to the low cloud density. The highest over- 
pressure that has been measured experimentally is 0.1 bar. 
However, the flame front within a cloud enveloping the 
topsides of the platform may experience obstacles, generat- 
ing turbulence and increasing the overpressure. Actual 
overpressures that would be experienced at points on the 
topsides are impossible to predict. However general consen- 
sus is that the peak overpressure could be up to 0.2 bar. 
UCVEs also generate radiation levels that are lethal to 
people exposed. 


B1.2.3 Topsides Pool Fire 


The large quantity of oil released during a topsides oil 
blowout could not be dealt with by the rig drains. Oil would 
accumulate on the drillfloor and overflow down stairways and 
other gaps. The whole of the central part of the installation 
would be engulfed, although muster stations would not be 
affected. Radiation levels would approach 100kW/m2. Oil 
would fall onto the sea surface and if ignited, could impair 
evacuation by lifeboat or other means. 


B1.2.4 Sea Surface Gas Fire 


A subsea blowout will result in a bubbly flow of gas through 
the sea and development of a ‘subsea plume’ with the shape 
in cross-section of an inverted cone. The velocity of the gas 
as it breaks the surface, for all reasonable water depths, will 
be of the order 5 m/s. However, due to the low concentration 
of gas in the plume, 10% or less, the mean velocity will be 
one-tenth of this, or less. This is close to the maximum laminar 
burning velocity of methane, which is 0.45m/s. Whilst the 
mean velocity over the plume may not be sufficient in theory 
to maintain combustion, this is probably compensated by the 
higher bubble rise velocity. Since case histories of sea surface 
gas fires exist, itis reasonable to assume that any combustion 
would be continuous. 

If the gas ignites, the resulting sea surface gas fire will have 
a flame that is laminar, instead of turbulent as in the case of 
a topsides blowout. Radiation levels from laminar flames are 
typically one order of magnitude less than those from turbu- 
lent flames, and in this case will be insufficient to affect 
escapeways or shelter areas, although the columns may fail 
quickly (within 30 minutes) if direct flame impingement were 
to take place. Radiation levels beneath one or more lifeboat 
stations may be high, preventing the use of the lifeboat. 


B1.2.5 Sea Surface Pool Fire 


Oil released from a subsea blowout could cover much of the 
sea surface beneath the installation depending on the wind 
and current. Radiation levels would lie in the range 50- 
100kW/m? at the sea surface. Radiation would not be 
sufficient to impair escapeways or muster stations in the short 
term, however a pool fire beneath a lifeboat station would 
prevent use of that lifeboat. 


B2 Evaluation of the PLL 


The PLL is evaluated using the event tree of Appendix C 
(Table 4 and Fig 3). Fatalities are estimated for each event tree 
outcome B1 to B13 and for each level of fire and blast protection 
proposed (Table 2). The estimated PLL is found by summing 
over each event tree outcome for each level of fire and blast 


Table 4 - Outcome frequencies for blowout events 


Outcome frequency 
Per unit year 


9.3 x 10°5 


Outcome | Description 


Bi Topsides jet fire/topsides 


pool fire 
UVCE/topsides jet fire/topsides 
pool fire 


B2 


B3 Pollution by oil and gas 

B4 Topsides pool fire 1.8 x 105 
B7 UVCE/topsides jet fire 6.4 x 104 
Pollution by gas 3.7x 10-3 
B9 UVCE/sea surface gas fire/sea 

surface pool fire 

Pollution by oil and gas 
Pollution by oil 


B12 UVCE/sea surface gas fire 8.5x 104 
B13 Pollution by gas 


protection. The likelihood of fatality of personnel at a given 
location is estimated in respect of the effects of thermal radia- 
tion and overpressure on the following: 
people immediately exposed. 
people who may not be immediately exposed, but who may 
not be able to escape, and who may only have short term 
protection. 
fire resistant and blast resistant walls (Table 1) 


The results are presented in Table 3. 


An estimate of the distribution of personnel about the instal- 
lation is required. For the present hypothetical example, it is 
assumed for instance, that there are 40 personnel present in the 
accommodation and 5 in the machinery house, with a total 
complement of 80. The PLL is not particularly sensitive to this 


distribution, other than on the total number of people outside 
the accommodation. 

Evacuation in itself can be dangerous and it is important to 
assess the scenario-dependent risk of evacuation. It is assumed 
that evacuation by helicopter would not be attempted during 
a blowout. The success rate of evacuation by lifeboat is based 
on a separate study [4]. A fatality rate of 0.04 is assumed, an 
average figure for all weather conditions. The number of 
personnel who successfully enter the lifeboats is assumed to 
follow a linear distribution, from zero after 27 minutes from the 
initial incident, to the entire remaining evacuees present at the 
muster station (subject to lifeboat capacity) after 37 minutes. 
The fatality rate for personnel evacuation into the sea is 0.11. 
This figure is averaged for weather conditions and is a mean 
figure for the use of liferafts or passing directly into the sea. 
The above data, like others used in the present paper, are simpli- 
fied figures used only to derive the present hypothetical 
example. 

Judgement is required in some instances. As an illustration, 
in both outcomes B1 and B2, the durability of the TSR to fire 
is critically important. However in outcome B2 unlike outcome 
B1, its durability after being exposed to a blast is also important. 
Should the TSR not be blast protected or should the firewalls 
not be designed to withstand a fire followed by a blast, radiation 
from the jet fire and pool fire will penetrate the bulkheads effec- 
tively immediately. More detailed analyses are thus required to 
estimate the evacuation success rate. 

The likelihood of successful evacuation is easy to assess in 
many cases. For instance, a topsides pool fire (outcome B4) 
would develop over sufficient time to allow all personnel 
outside the TSR to reach muster stations. This would not be 
the case in a jet fire. 


Above Oil Gas Immediate Delayed Outcome 
sea level present present ignition ignition 
Bl 
0.18 
Yes —_—___— B2 
0.9 0.82 Oats 
No 0.1 0.85 B3 
0.1 0.30 B4 
0.9 0.70 B5 
a 0.18 Bo 
owout 
9.0x103 9.65 0.82 oe sf 
per 0.35 0.85 B8 
unit/year 

y 0.30 B9 
0.9 0.70 _ B10 

0.1 | 0.1 
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0.30 B12 
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Fig. 3 Blowout Event Tree 


APPENDIX C 
FREQUENCY OF BLOWOUT AND 
LIKELIHOOD OF IGNITION 


Cl Frequency 


A database on offshore blowouts exists within LRSTD. The 
data are generally consistent with other, commercial databases, 
for instance [6]. Included are spectacular blowouts such as the 
Mariner | off Trinidad in 1973 and the West Vanguard in the 
Norwegian sector of the North Sea in 1985; also spectacular 
ignited blowouts such as the Zapata Lexington in the Gulf of 
Mexico in 1984 and the Ocean Odyssey in the UK sector of the 
North Sea in 1988. From the databases the frequency of inci- 
dents of a given severity experienced by units of given type 
operating in various regions, may be derived. 

It is essential to isolate data specific to the type of offshore 
installation under review, and to the mode of operation. Drilling 
blowouts are more common than production blowouts by an 
order of magnitude, expressed per unit-year. Semi-submersible 
units are relatively prone to blowout owing to the demands of 
disconnection and reconnection. Furthermore with the well 
shut-in and the BOP isolated on the sea floor during poor 
weather, if the well is not stable, cratering may occur. On the 
other hand, the ability of semi-submersible units to move off- 
station will make them less susceptible to serious or severe 
damage during blowout. Another factor is that semi 
submersible units usually undertake exploration drilling under 
uncertain well conditions, which fixed units do not. 

It is furthermore essential to isolate historical data specific 
to the region of operation. As a particular example, steps to 
avoid blowout are less rigorous in the Gulf of Mexico, where 
weather conditions are more favourable, platforms less valu- 
able. and) environmental protection movements — less 
advanced, than in the North Sea. Consequently the probabil- 
ity of blowout per well drilled is about twice as high in the 
Gulf of Mexico as in the North Sea. Furthermore there are 
generalised differences in geological structures affecting the 
likelihood of kicks and shallow gas occurrences. Accordingly 
the databases herein are based on the British and Norwegian 
sectors of the North Sea. 

Drilling blowouts often bridge or deplete and this will reflect 
in the statistical breakdown of severity. 

From the year 1980 onwards, data indicate the following 
frequencies for specified unit types and regions: 


Mobiles generally, worldwide 1.2 x 102/unit-yr 


Semi -submersibles, worldwide — 1.4.x 10-2/unit-yr 


Mobiles generally, North Sea 
(expressed in calendar years) 


1.1 x 10/unit-yr 


(figures for mobile drilling units involved in activities such 
as support, are neglected). 


The equivalent data for semi-submersibles in the North Sea are 
unreliable due to limited exposure to the present date. However 
the close correspondence between the frequencies of blowout 
on mobile units and semi-submersibles worldwide, indicates 
that data for mobile units generally can be applied to semi- 
submersibles. A satisfactorily large database exists on mobile 
units in the North Sea. 

The data demonstrate that 85% of all blowout incidents on 
mobile units occur during drilling operations. The remainder 
occur during testing, completion, and workover, etc. This brings 
the frequency of blowouts for semi-submersible drilling units 
in the North Sea to 0.85 x 1.1 x 102 = 9.0 x 10-/unit yr. 


A blowout during drilling of an exploration well is 3.7 times 
more likely than blowout during drilling of a development well. 
Although most semi-submersible units undertake exploration 
drilling, the likelihood of blowout should be revised were 
drilling deployment to be non-typical. 

Typical drilling deployment for semi-submersible units 
involves an average number of wells drilled per year of 3.9. 

The risk will be proportional to the actual number of wells 
drilled per year. It is assumed that drilling procedures are 
consistent with North Sea practice. It must be recognised that 
the risk of blowout will be increased with respect to the above 
estimates if drilling in formations that are particularly weak or 
have abnormal pressure or abnormal pressure gradients. The 
trend lately has been to drill under ever more challenging condi- 
tions, but the blowout frequency has been surprisingly constant. 
The difficulties are compensated for by improved drilling 
equipment and by taking relevant precautions. It is assumed 
that future deployments of the present unit will be commensu- 
rate with this principle. 


C2 Probability of ignition 


Blowout incidents are evaluated using an Event Tree, Fig 3. 
Quantification of the event tree summarised in Table 4 is 
described in the paragraphs below. 

According to [7], 65% of all drilling blowouts occur above 
the sealine, the remainder being subsea. 

It is recognised that 20% of drilling blowouts are reservoir 
blowouts and that about 50% of reservoirs contain a significant 
amount of oil. The probability of oil being present in a blowout 
is therefore 0.1. A probability of 0.07 is quoted in [8] but this 
figure is less substantiated and is based on US and Gulf of 
Mexico data. The actual amount of oil expelled whether ‘signif- 
icant’ or very large, is not relevant to the amount of damage 
caused to an installation should the oil ignite, since in blowout 
terms the relative amount required to cause damage is slight 
(although the amount of oil present is naturally important in 
environmental terms). Oil only blowouts are very rare, about 
1% of all blowouts. These figures are based on LR experience 
of worldwide conditions but also reflect North Sea conditions. 

According to [7], about 30% of offshore blowouts ignite. 
This is the same for both gas and oil blowouts, but oil blowouts 
are relatively more likely to ignite later. This is in line with the 
following reasoning. Oil may not easily ignite spontaneously 
(eg. by sparks generated by the blowout) because the oil tends 
to quench small sparks. On the other hand, if the oil runs over 
the platform giving off gas over an extended area where it may 
reach various sources of ignition, ignition seems likely. 
However, in terms of consequence analysis, the concepts of 
‘immediate’ and ‘delayed’ ignition are not particularly relevant 
to oil blowouts, since even if an oil blowout is ignited early 
before much oil is expelled, the fire will grow as the amount of 
oil increases. 

The probability of ignition of a gas blowout is not discern- 
ably dependent on whether the blowoutis a topsides ora subsea 
blowout. Whilst a platform blowout will originate closer to igni- 
tion sources, the momentum of the jet may carry it away from 
the platform; similarly, whilst the source of a subsea blowout is 
further from any ignition source, the buoyancy of the gas may 
carry it toward them. It is assumed that 60% of gas blowouts 
which ignite undergo immediate ignition [7]. 

The probability of a subsea blowout occurring in combina- 
tion with oil-only discharge is very low and in this case the 
probability of ignition is negligible. However combustion of oil 
would inevitably take place if accompanied gas were ignited. It 
is further assumed that if a topsides oil blowout is ignited, there 
may be burning oil falling from the platform but this will not 
be enough to maintain a sea-surface fire of sufficient intensity 


to impair evacuation by lifeboat. This is because the oil will fall 
to the sea over localised areas only, and oil lying on the sea 
surface is difficult to ignite and combustion ts difficult to main- 
tain. 

A subsea blowout in which the gas forms a ‘subsea plume’ 
before reaching the sea surface would not reach an ignition 
source until the gas reaches the platform. By this time sufficient 
gas would have accumulated to cause a UVCE. Therefore a jet 
fire (in this case termed a ‘sea surface gas fire’) could not occur 
unless preceded by a UVCE. As stated above the probability 
that gas from a subsea blowout will find an ignition source is 
0.30, as for a platform blowout. 

A sea surface pool fire could occur only if preceded by a 
UVCE and a sea surface gas fire, as discussed above. However 
it is possible for a topsides pool fire to occur without being 
preceded by gas discharge and ignition, although it is a low 
probability event. 
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SYNOPSIS 


This paper indicates that existing engineering design disciplines 
can be usefully supplemented through the use of Availability, 
Reliability and Maintainability technology, hereinafter called 
Availability Engineering (AE), to enhance the functional 
integrity, safety and associated costs of complex systems. AE 
can be effectively applied in the technical design, manufacture 
and operation of any system, plant or process. 

The paper will show that this technology can provide 
management with a means of containing resources and of 
obtaining a clear overall view of any system, such that functional 
integrity, safety and commercial performance may be opti- 
mised. 

The use of AE in programme management of modern plant, 
machinery, equipment or systems, when applied by experi- 
enced engineers may marginally increase design and capital 
costs but will significantly reduce the total life cycle costs with 
considerable benefit to both safety standards and commercial 
goals. 

This paper does not set out to provide a textbook for AE. 
Sources of such data are found in the References. (see 
References 1,5, 12,14and 15) Itis however, intended to provide 
an overview and refers to current and future methods for the 
achievement of safety and commercial benefits through AE. It 
is also aimed at provoking thought about the use of AE in the 
many and diverse applications in which LR services are and will 
be involved. 

LR is committed to the development and upholding of stan- 
dards and has, through the support of its Research and 
Development (R and D) Committee, extended its expertise in 
AE. Itis believed that a wider awareness of AE and its potential 
is of advantage to both LR and its clients alike. 


1. INTRODUCTION 


In January 1986 the Challenger space shuttle exploded during 
launch (see fig 1). The spectacular and horrifying deaths of 
seven astronauts were broadcast worldwide. In the days that 
followed attention was drawn to one small component. Closer 
to home, the Clapham rail disaster made all too clear the impli- 
cations of mis-maintenance (see fig 2). Through such events 
public awareness of disasters, and the need to make reliable 
and safe systems, continues to expand. 

At the same time, the economic benefits of producing reli- 
able and easily repairable systems are being championed. The 
commercial advantages are undeniable and many companies 
promote their products as reliable and requiring little maint- 
enance above all other factors. For further inducement, the 
costs of litigation associated with injury and death continue to 
spiral and there is always serious adverse publicity surrounding 
fatalities. In response to all these factors more and more compa- 
nies are considering new ways of making their products safer 
and more reliable. It is therefore not surprising that the use of 
Availability Engineering (AE) technology within the Safety 
Technology Department of LRID is rapidly gaining commer- 
cial demand. 

Under different acronyms (such as R&M, AR&M, ARM 
and RAM) the value of AE has been recognised within military 
based industries for many years. The methods to improve a 
system's availability have been developed through the need for 
readiness on demand and reliability in use that is associated 
with military equipment. Formalization and further refinement 
of AE methods has occurred because of the consistently higher 
expectations and requirements for each new generation of 
defence and commercial systems. 

The engineering methods outlined in this paper can assist 
considerably in the prevention or limitation of human and 
economic losses. The techniques provide quantified assessment 
of the probability of a failure during a defined period and help 
to ensure that safe and rapid repairs can be made. The result 
of correctly applied AE is to minimise the potential risk by 
limiting the frequency and duration of downtime. 

As an introduction to Availability Engineering some case 
studies have been presented within this paper. For those wish- 
ing to look further brief descriptions of the techniques used are 
supplied in appendices. 


Fig. 1 The Space Shuttle Challenger Disaster 


Fig. 2 The Clapham Rail Disaster 


2. LLOYD’S REGISTER INVOLVEMENT 


The name of Lloyd’s Register has long been synonymous with 
safety and quality, its very raison d’etre lying in the establish- 
ment and assurance of safety standards. Increasingly its clients 
must ally safety with the commercial viability of their opera- 
tions. To date, however, historically LR’s involvement in the 
detailed aspects of Availability Engineering has not included 
extensive association with reliability, maintainability or avail- 
ability planning, assessment or approval. These aspects apply 
particularly where technologies are electronically complex and 
involve computers and software for their control. 

AE brings together through the use of structured methods 
the traditional approaches associated with good engineering 
practice. The LR case studies involving these disciplines are 
intended to illustrate the value of the integration of methods 
which will increasingly impact on LR’s technically competitive 
position, and future capabilities for safety and availability 
assessment of advanced and complex systems. 

With the capability to service all sectors of industry and all 
disciplines, including human factors, mechanical design, elec- 
tromechanical design, electronics and software, the technology 
of AE fits well into the current and future strategies of LR. 


3. APPLICATIONS 
3.1 Industrial 


For AE engineering activities, LR frequently works from its 
traditional standpoint of third-party assessor. STD also 
provides services and training in the use of AE. 

STD has been involved in many contracts employing avail- 
ability, reliability and maintainability to assess and control the 
safety of systems. AE methods are used to quantify the prob- 
ability of occurrence of events or processes identified through 
traditional hazard identification techniques and to supplement 
traditional deterministic safety analysis and design methods. 

The principal industrial case study presented here is based 
on our involvement in the development of engine manage- 
ment control systems for a major automotive manufacturing 
group, which for the purposes of confidentiality will be 
referred to as ‘Al Cars’. The use of advanced technology is 
essential to the group’s future market, its image (for safety, 
and reliability) its profits and cushioning it against legislative 
risks. 

The case study presented in 3.1.1 is an example of the 
approach adopted in achievement of the client’s safety, 
availability and risk limitation requirements. 

Two additional studies illustrating the use of AE techniques 
are given below. 

The first is a current programme of work for Docklands 
Light Railway (DLR) and involves participation in a Safety 
Audit of the re-signalling programme. The automated train 
control system affects 22 Km of double track as illustrated in 
fig 3.1. The re-signalling programme involves the installation 
of a control system based on a moving-block principle which 
enforces a minimum safe separation between trains. This will 
replace the current system, based on a fixed-block principle, 
which effectively closes lengths of track where a single train is 
located. The new design approach should increase the avail- 
ability or capacity of DLR transport. 
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Fig. 3.1 Docklands Light Railway System Map 


LR Safety Technology Department's involvement in this 
safety audit provides third party design assessment to determine 
the risks associated with the new signalling system. The analyses 
performed are related to both safety and system availability 

In particular STD's study addresses the interaction of 
Vehicle on Board Control Computer (VBCC) and Vehicle 
Control Computer (VCC). An example of the type of display 
in use at the vehicle contro] centre is provided in fig. 3.2. 

The second is a more basic example of the use of AE and in 
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Fig. 3.2 An Example of Vehicle Control Centre Display of 
DLR Status 


particular reliability engineering and relates to the provision of 
assistance to National Power in the control of the development 
and production programme for their Flue Gas Desulphurisation 
(FGD) plant for the Drax power generation facility. Here we 
provided guidance on the implementation and management of 
a reliability programme which National Power recognised 
would provide increased visibility and control over resources, 
expenditure and management. This control was particularly 
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relevant to sub-contract effort. The contractually binding sub- 
contractor Reliability Programme Plan provided National 
Power with a useful method to supplement management of the 
design and development process of the FGD plant. 


3.1.1 Case Study 


The technology used for the proposed design solutions for Al 
Cars electronic engine management system, though not ‘state 
of the art’ was extremely advanced. The use of ‘state-of-the- 
art’ technologies presented too high a risk for equipment in 
which availability and safety were essential. The proposed 
system made use of software, electronics, electro-mechanical 
and mechanical sub-systems which were integrated to provide 
the required functionality. 

Al Cars required that STD provide an independent assess- 
ment of the engine management control system to generate 
confidence in the system's safety and availability. 

Al Cars were also concerned about the financial conse- 
quences of litigation following an accident, particularly in their 
United States market. With control of the vehicle being signif- 
icantly influenced by electronics and software it could be 
reasonably envisaged that in some cases attempts would be 
made to allocate causes of accidents to electronics and software. 
In such circumstances, the best defence is to provide evidence 
that the most recent or best industrially acceptable practices 
had been used in system design, development and manufacture. 
The LR STD analyses, which were extensively supported by 
Applied Information Engineering (AIE) Department, there- 
fore assessed the design and development process to verify that 
this was the case in Al Cars achievement of defined safety goals. 

Through analysis, sufficient data was derived to technically 
‘prove’ that: 


(i) Nosingle failure modes or associated effects existed which 
could result in a potentially unsafe system. 

Combined failure modes, which could result in a poten- 
tially unsafe system, had a probability of occurrence which 
is within pre-defined design limitations. 


(ii) 


STD was also required to provide an industrial training 
package to explain the agreed approach for the analysis meth- 
ods to achieve Al Cars’ requirements. 

Requirements (i) and (ii) as described were readily achieved 
by Failure Mode and Effects Analysis (FMEA) and Fault Tree 
Analysis (FTA) respectively. The necessity for quantification 
of probabilities caused no problem for the hardware due to the 
use of established reliability modelling and prediction methods 
as outlined in Appendix C. However an understanding of the 
limitations of software reliability quantification and of the 
control of software development processes was essential (See 
References 4, 6,8 and 13). Confidence in the reliability of devel- 
oped software could only be achieved by implementation of 
current design standards for safety critical software. 

The planned process for the verification of the design solu- 
tion was tailored to be cost effective and was based on use of 
the following methods (refer Appendix C). 


Functional Requirement Capture (FRC) 

Generation of Reliability Block Diagrams 

Preliminary Hazard Analysis (PHA) 

Failure Mode and Effects and Criticality Analysis (FMECA) 
Fault Tree Analysis (FTA) 

Reliability Allocation, Analysis and Assessment (AAA) 
Validation of adequacy, and adherence to Software Methods 
Electronic and Mechanical Design Review 

Test Validation 

Implementation of a DRACAS system (seven year duration) 
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These methods (apart from PHA) are described in the rele- 
vant Appendices and are summarised here to provide 
understanding of the strategic approach adopted for this work. 

The first and essential stage of the programme was to learn 
about the system: 


What is the system required to do? 

How harsh is the environment it will be working in? 

What are the safety implications of its primary functions? 
What are the main components of the system likely to be? 


Gathering information to answer these and other questions 
involved performing a Functional Requirement Capture 
(FRC). This process provided the knowledge essential to gener- 
ate an initial estimate for the system’s reliability and allowed 
the first analysis, a Preliminary Hazard Analysis (PHA), of 
system safety aspects to be performed. The PHA identified a 
number of important aspects of the design, such as:- potential 
hazards, safeguards, areas where hazard elimination or risk 
reduction should be considered, human error factors and areas 
which required extensive testing. 

Quantification of hazard probability due to functional fail- 
ure was achieved in two stages. The first involved developing 
a reliability block diagram to represent the system. The second 
required reliability prediction based upon recorded data and 
probabilities derived from mathematical models described in 
MIL-HDBK-217F (see Reference 4). Results of reliability 
analyses were presented in tabular format (see fig. 4) to allow 
rapid identification of reliability critical areas. 

Following on further from the PHA, more detailed exami- 
nations of the system were performed in order to detect as many 
potential safety and availability problems as possible. One of 
these was a Fault Tree Analysis (FTA) which allowed an engi- 
neer to work down from the ‘top events’, as identified by the 
PHA, to determine the initial causes which lead, in combina- 
tion, to hazardous states. A Failure Mode and Effects Analysis 
(FMEA) acted as the other side of the coin, being a ‘bottom 
up’ technique which allowed an engineer to determine the 
effect of a component or sub-system failure on overall system 
safety. It was also necessary to review the electronic and 
mechanical designs to ensure they met the specification 
requirements. 


Fig. 4 


In order to ensure that all problems were properly commu- 
nicated and subsequently addressed, a formal system was 
implemented to control data. Known as a Data Recording And 
Corrective Action System (DRACAS) this ensured through 
the use of forms and a fully documented procedure that prob- 
lems were identified to the correct people and were addressed 
in a timely and controlled manner. DRACAS is a well estab- 
lished method (see Reference 15) which ensures that all 
identified problems or anomalies receive attention. Its use, as 
a ‘closed loop' data recording system in this programme of work 
was essential to the control of information and integrity of 
conclusions. 


3.1.2 Summary 


The engineering analysis described here is one that has origi- 
nated from Al Cars need to address the problems of safety and 
financial viability ina competitive market place. In this market, 
great emphasis is placed on safety and availability — the future 
of the company is dependent on achievement of both attributes 
—and limiting the risk of cost incurred due to litigation, notably 
in the US market, following accidents. 

The approach that Al Cars have adopted to the control and 
assessment of safety, availability and financial viability of their 
future products has been justified to the management within 
their company as being due to the inevitable extension of legis- 
lated (US, UK and EEC) safety requirements. 

The requirements call for the integration of AE and safety 
engineering in the practical optimisation of the control system’s 
design to ensure financial viability. 

It is considered by STD that the company has adopted a 
technically advanced and intelligent approach to, albeit limited, 
validation of their design solutions for the automotive industry. 


3.2. Offshore Applications 


STD’s ARM involvement in offshore activities has included the 
assessment of the integrity of simulation software developed 
for North Sea pipelines to determine the availability, safety and 
financial viability for life extension. 

The software is intended to make visible, calculate or 
provide evidence of the potential availability of the pipelines 


in the future. It is intended to support justification for the life 
extension and to provide data for an Inspection, Repair and 
Maintenance (IRM) policy. It therefore is an application of AE 
techniques making a major contribution to investment, finan- 
cial viability and safety. 

The system’ safety considerations relate to corrosion or stress 
induced failures of gas pipeline risers to offshore platforms. 


3.2.1 Case Study 


Conoco (UK) Ltd recently undertook a comprehensive 
Pipeline Re-certification Study Audit (PLRS) on the pipelines 
in the Viking gas transportation system to confirm that the 
pipelines were safe to continue to operate, and that the 28 inch 
pipeline was “fit for service” for the remainder of the life of the 
fields (see figs 5 and 6). 
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Fig. 5 Conoco Southern Gas Gathering System and 
Associated V-Fields 
Reproduced courtesy of “Oilfield Publications Ltd” 


It was considered that computer based environmental simu- 
lation (see Reference 10) would assist in the determination of 
the pipeline’s likely remaining service life so that Conoco would 
be able to determine if unacceptable safety or economic risks 
would result from the life extension. Conoco would also be able 
to rationalise and quantify the pipeline inspection and certifica- 
tion requirements for their Southern North Sea operations in 
the Viking and Victor gas fields. 

The computer reliability model was prepared based on a 
probabilistic approach to pipeline decay which covered both 
independent random events, (that can be combined relatively 
easily using simple Fault Tree Analysis (FTA )theory), and time- 
varying failure modes which interacted with each other. The 
latter had to be simulated using Monte Carlo simulation analysis 
in which the probability of failure was determined by sampling 
from failure distributions using random numbers. Since the 
outcome of a simulated pipeline life time can be either success 
or failure, depending on the random numbers generated, the 
calculation had to be repeated many times to provide confidence 
in an estimate of the probability of failure. 

The audit undertaken by Lloyd’s Register on behalf of 
Conoco was intended to ensure that the computer based relia- 
bility simulation model, termed the Conoco Pipeline Reliability 
Model or CPRM, of the Viking Pipeline system was ‘fit for 
purpose’. The purpose was to predict the probability with time 
of a pipeline failure that would result in an inventory release. 
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Fig. 6 Conoco Southern — Viking Field 
Reproduced courtesy of “Oilfield Publications Ltd” 


Specific objectives of the audit were: 


¢ To make conclusions on the suitability of the overall model 
to fulfil its intended purpose 

¢ To comment on the accuracy of the model 

¢ Tocomment on the limitations and weaknesses 

¢  Tosuggest potential beneficial refinements, both short and 
long term 

¢ To estimate the improvements resulting from the refine- 
ments 


During the detailed review stage of the audit the following main 
activities were carried out: 


e¢ The failure models that had been derived for each module 
within the pipeline reliability programme were reviewed 
for suitability, correctness and accuracy. The possibility of 
important failure modes being omitted was considered. 

¢ Damage statistics which had been used were reviewed and 
compared with LR’s internal records and published 
sources. 

¢ Conoco records, where available, were reviewed to assist in 
ensuring that the defined failure models had been correctly 
applied to the specific circumstances of the Viking pipeline. 
Such records included: 


e — Inspection reports (free spans, weight coat condition, 
presence of debris, condition of cathodic protection 
system). 

¢ Design basis (functional loads, environmental data, 
e€tc:,): 

Operational records (pressure, temperature records). 
Environmental records. 

Damage Records (nature and location of damage — 
strength assessment). 


“ 


¢ — Reliability specialists examined the conversion of each fail- 
ure model to a standard failure function to ensure that a 
suitable function had been chosen and correctly applied. 
e The integration of each failure module into the overall 
simulation model and the correct functioning and applica- 
tion of the model was examined for logical and statistical 
correctness. 
e The function and correctness of the model software were 
reviewed by LR’s software engineers. This review covered: 
° Existence of visible errors (e.g. undefined data items 
accessed), 
¢ Data and Control Flow (e.g. variables written twice 
and not read). 
e Dangerous consiructions (e.g. arithmetic ‘if’ or equiv- 
alence statements) 
¢ Modularity and overall complexity (e.g. number of 
‘GOTO’ statements). 
¢ Number and usefulness of comments. 
e User documentation — compatibility with actual 
program. 


The audit was completed by various departments of Lloyd's 
Register. Conoco UK provided a pipeline reliability model and 
its supporting documentation for review. The results of the audit 
were described and included evaluation of the background 
reports on failure mechanisms, the development of failure 
models, simulation software program coding and software assess- 
ment. 

A necessary part of this audit was the review of the supporting 
reliability model documentation and the reports on pipeline fail- 
ure mechanisms. The reports were reviewed by relevant specialist 
departments in Lloyd’s Register. The reliability models and 
theory of each failure mechanism were evaluated and their accu- 
rate incorporation into the overall pipeline reliability model was 
checked. The functions and correctness of the model software 
were reviewed. Supporting documentation formed a valuable 
background to the various failure mechanisms and the factors 
affecting them. 

Reliability models identified in these documents were in most 
cases conservative. 

In the coding of failure models into algorithms only one func- 
tion was identified that did not appear to be substantiated and 
this was in the module covering internal pipeline corrosion. 

The version of the program supplied by Conoco for evaluation 
did not contain modules covering spanning and lateral stability. 
These, along with other omissions highlighted in the audit report 
such as vortex shedding induced fatigue, trawl board impact and 
dropped objects were considered to be important omissions 
which if not incorporated could cause a significant error in the 
relative and overall distribution of pipeline failure probability. 

Contrary to expectation, and the laws of physics, it was noted 
that interactive failure mechanisms (i.e. internal corrosion, exter- 
nal corrosion and fatigue), which were the second largest 
contributor to overall failure probability after extreme events, 
produced a time decreasing failure rate. 

The results of further testing of the program endorsed the 
concerns expressed above and indicated that anomalies existed 
in program function. 

The value of the simulation approach to AE is clear given the 
cost of AE simulation effort compared to the capital costs. 
Extension of this work will provide financial benefit when the 
anomalies revealed as part of LR’s independent audit are 
corrected. 

The outline presented here of simulation methods provides 
an indication of the considerations that must be included in an 
availability assessment. It is, as with all AE methods, a formal 
method which enforces an objective and necessarily comprehen- 
sive approach. 


The full details of this project are available within LR and 
underline the detail required for simulation of complex 
systems. 


3.2.2 Summary 


The use of the methods described here provide further evidence 
of the commercial value of the investment in AE. As for DLR, 
National Power and “A1 Cars”, the relatively small cost of AE 
when compared with the capital investment justifies its appli- 
cation when the benefits are considered. 

The pipelines involved in this study have values in the order 
of many millions of pounds. The cost of the study amounted to 
asmall fraction of this. The use of AE methods can have a major 
impact on clients’ investment, safety and commercial image. 

In this example LR performed the role of integrity assessor, 
but could equally have acted as AE simulation development 
specialist. 


3.3 Marine Applications 


The increasing use of complex electronic/software based 
control systems in ship design and operation is rapidly changing 
the value attached to safety and commercial risk issues associ- 
ated with such systems. An example of this can be seen in the 
use of Dynamic Positioning (DP) systems which depend for 
safety and hence commercial viability on the reliability or avail- 
ability of complex electronics and software. Currently, as part 
of a Department of Trade and Industry safety critical system 
research program LRSTD are involving Strathclyde University 
in an assessment of the value of dynamic testing of software in 
safety case preparation —with particular reference to DP systems. 

Dynamic testing requires functional, operational and envi- 
ronmental simulation. The case study discussed here involved 
higher level, less functionally detailed simulation to assess the 
viability of LNG importation. It was, however, an international 
programme through which LR produced Availability simulation 
software (see Reference 10). The software, which is now being 
used by major LNG importers world wide, evaluates the viability 
and risks attached to multi-million pound investments. 


3.3.1 Case Study 


The example presented here is based on simulation software, 
developed by LR, for the assessment of the availability of 
Natural Gas send out. The software was based on the definition 
of processes involved in Liquid Natural Gas (LNG) importa- 
tion chains. An availability simulation model was developed, 
based on data derived from a questionnaire supplied to the 
Groupe International des Importateurs du Gaz Natural 
Liquifié (GIIGNL), supplemented by Lloyd’s Register’s 
marine data. The information derived from the questionnaire 
includes data from 11 companies from Europe, the US and 
Japan. 

The availability simulation model, which in this case was 
targeted at financial viability of systems, included consideration 
of the following: 


¢ A basic model of the exporting terminal 

¢ A detailed model of the marine transportation phase — 
which included 

Marine model rules 

Chain definition 

Ship definition 

Ship failure data 

Planned ship outages 

Ship voyage information 

¢ Detailed importing terminal data 
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The model required: 


¢ Fault Tree Analyses (FTA) for the importing terminal, 
with the 'top event’ being zero gas send out 

¢ Failure Mode and Effect Analysis (FMEA) for the marine 
transportation phase 

e Marine transportation phase data definition 


The model specification defined, in detail, the interfaces, func- 
tion and output of the software which was essential to the 
derivation of LNG send-out availability through the simula- 
tion of user defined LNG importation chains. 

The program simulated the operations and interactions 
that occur within the importation chain over a specified time 
period with predetermined send-out and storage require- 
ments. Output from the program (see figs 7 and 8) identified 
the probability and duration of a loss or limitation in send- 
out capacity together with data to indicate those elements 
having a major impact on send-out availability. The program 
modelled the export, transport and import phases of the 
process. 

The approach of simulation based assessment of availability 
was essential, due to the numerous and complex interactions 
involved in the process of LNG export, transport, storage, 
vapourisation and send-out. 
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Table 1 - Key to LNG Receiving Terminal Model (fig 9) 
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The approach also allowed GIIGNL members to config- 
ure their models to match current designs and use the ‘what 
if ?’ option that is associated with simulation. This capability 
is of particular value in this instance where experiments with 
the use of the actual facilities (number of ships, ship capacity, 
storage capacity and similar parameters) were not practical 
and yet the operational configuration had a significant effect 
on system availability and commercial viability. 

The program provided a ‘user friendly’ interface to 
minimise the requirement for a user guide. The program- 
ming language used was SIMSCRIPT II.5 which was 
sufficiently flexible to create a model that could cope with 
all foreseen characteristics of the LNG importation chain. 
The program provided information on the probability of a 
decrease or loss of natural gas send-out and the associated 
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Fig. 9 LNG Receiving Terminal Configuration 


duration, for defined periods and output capacity require- 
ments. 

Overall plant send-out and storage requirements were user 
defined parameters, set on a monthly basis. 

The simulation was based on discrete events with a next- 
event time advance mechanism. The simulation clock was 
advanced to the time of occurrence of the most imminent of 
future events. 

The system's state was updated to take into account the vari- 
ous operational phases. When necessary, phase changes that 
had occurred during the previous interval, were simulated and 
checks made for the possible occurrence of events associated 
with these phases. Ship position/phase and both ship and 
importing terminal LNG tank contents were calculated for each 
identified event. The simulation ceased after a predetermined 
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period and output was provided in default or user specified 
format from the report generator section of the program. 

Confidence levels were calculated for send-out availability 
information. In general confidence bands decrease with the 
increasing number of simulations carried out. For this reason 
a ‘simulation run’ consisted of many experiments, each exper- 
iment consisting of many simulations. Mean values were 
derived for each experiment, the derived means being 
normally distributed. From this distribution, confidence values 
were calculated. An example of the complexity associated with 
this simulation software is evident from the basic and user vari- 
able model of an importing terminal displayed in fig 9 and 
Table 1. 

The area of particular interest here is associated with the 
simulation of the marine transportation phase of LNG which 


is summarised here. All extreme events (grounding, sinking, 
fire and explosion) were excluded from the simulation due to 
the low frequency of their occurrence. 

The simulation design solution for this phase of the impor- 
tation chain was ‘tailored’ to: 


— comply with defined resources 

— identify all significant events which may 
cause shipping delay 

— achieve a valid simulation of events 


The model produced, was designed to simulate the following 
diagram (fig 10). This diagram does not specifically show ‘dead 


time’ — due to outages caused by dry-docking and ship survey 
which were included in the simulation. 
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Fig. 10 Default LNG Transportation Model 


A high level Failure Mode and Effects Analysis was 
completed to identify delay factors associated with each step 
and phase of shipping activities. The user was prompted to 
enter data to define normal operational times, delay times, 
probabilities and associated numerical data to represent the 
marine transportation phase. Wherever appropriate, data 
was entered and reported with due account of seasonal vari- 
ation. 

The program was provided with a GIIGNL approved set 
of default values and for the shipping phase, the default 
model simulated three 125,000 m’ LNG carriers, each making 
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around trip of 7000 miles. Each ship was assumed to be fitted 
with a four branch LNG manifold and single vapour return 
line. The ships were also fitted with all standard navigational 
aids and powered by steam turbines. The reliability of 
mechanical parts of the ship was representative of ships of 
the same size and type; default values were provided. 

The model was designed to be able to simulate up to 10 
LNG carriers of up to 200,000 m* capacity operating to 
deliver LNG to one importing terminal. Planned outages and 
the effects of other ‘dead’ time were modelled, to the extent 
that return to service was delayed. 

The data for failure frequencies of the ship systems and 
components was extracted from Lloyd’s Register’s comput- 
erised database. This database of in-service failures was 
compiled from surveyors reports on all surveys carried out in 
respect of classification aspects of hull and machinery items. 
The basic data and defects reported on all ships built since 
1960 and classed with LR was included on the records of over 
10,000 vessels. A breakdown of an LNG carrier was taken to 
occur if there was a gross failure of the machinery items listed 
in Table 2. The range of spare parts carried on board an LNG 
carrier was generally sufficient to carry out most repairs on 
machinery systems while at sea. 

Table 2 also presents the Mean Time Between Failure 
(MTBF) of the machinery items which could result in ship 
breakdowns. This data was presented in ship years — i.e. ship 
life, active or laid up, expressed in years. The MTBF’s were 
based on failure data from LR’s database for the first five 
years of service of ships classed with LR since 1970. It should 
be noted that the incidents recorded in LR’s database are 
defects (minor or major) and failures. On this basis the 
combined defect/failure rate was considered as a conserva- 
tive failure rate. 

Failure rate data was also determined from LR’s database 
covering the first twenty years of service of all LNG/LPG 
carriers classed with LR. However, this data was considered 
to be grossly pessimistic. The main reason for this pessimism 
was that this data includes all items having corrective action 
during the planned maintenance (planned outages of the 
vessel). The problem was overcome by considering only those 
defects occurring during the first five years of service. 

Items for which Table 2 shows no reported failures within 
the period were not included specifically in the marine model. 
Table 2 also lists the likely repair times to conduct repairs in 
the event of a major failure of the items likely to lead to break- 
down, and whether a repair yard is necessary to conduct the 
repairs. For the larger items the repair times included access, 
removal and replacement. 
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Considering these repair times and the MTBFs it was clear 
that the following machinery items needed consideration in 
the marine model (fig 10). 


¢ Main Gearing 
e High Pressure Turbine 
¢ Low Pressure Turbine 


HP Turbine 


Main 
Reduction 
Gearing 


LP Turbine Propeller 


Fig. 11 Turbine — Propeller Functional Default 
Configuration 


For all ship failures, excluding turbine failures, that required 
repair in a repair yard, assuming the vessel could not make its 
own way to the yard, the following options were available: 


e Await another vessel in which to off-load LNG (full load 
or heel) - LNG vessel lead time, estimated at | day, plus 
the necessary journey time. This new vessel would then 
continue with the loaded journey. Transfer of LNG, esti- 
mated at | day. 

¢  Towage toa repair yard. This aspect was dependent on the 
location of the ship when the breakdown occurred. As 
towage was not modelled specifically a mean towage time 
of 7 days was assumed at all locations on the route. 

¢ Gas freeing of ship storage tanks and associated equipment, 
warming up and then reinstallation, estimated at 4 days. 


Although the loss of both high pressure and low pressure steam 
turbines together would result in an engine breakdown, the loss 
of either one would result in a reduction of propulsion power. 
Based on previous studies by LR it was suggested the following 
speed reductions were to be applied if a turbine failed. Loss of 
HP or LP turbine would result in speed reduction by 30% or 
40% respectively. In such cases it was considered that the vessel 
would be able to proceed to the repair yard under its own power 
after delivery of cargo. 

An analysis of the ship’s route relative to the repair yard 
enabled a delay time (in addition to the repair time) to be esti- 
mated. 

The likelihood of structural failure resulting in the need for 
immediate repair at a repair yard was considered to be small. It 
was estimated that failures of this nature might be extensive and 
result in a considerable outage (damage might also occur to the 
cargo containment system or the repair could necessitate 
removal of part of the containment system). A consideration of 
incident rates of heavy weather damage and wear and tear 
suggested an MTBF of SO ship years was appropriate as a default 
value in the marine model. A repair time of 18 days was consid- 
ered to be reasonable. It was assumed that the vessel would 
continue to the importing terminal if 75% or more of its voyage 
had been completed — or would return to the exporting terminal 
if less than 25% had been completed. 

The repair of rudder failures was most likely to concern 
minor defects. However, defects of a more serious nature could 
result in loss of steering control. Failure data within LR’s 
database for rudders built since 1970 was examined to determine 
an appropriate default failure rate for the marine model. The 
common Mariner type rudder was taken as typical. 

Fracturing of the rudder plating generally results in minor 
cracking which would be detected and rectified at dry docking. 


Also, minor defects of the bearing region, including bear- 
ings/bushes, gudgeons and coupling components, due to 
corrosion, fatigue and wear, would also be detected and recti- 
fied at dry docking. More major defects such as bearing/bush 
loosening and fracturing, pintle loosening and fracturing 
could potentially cause loss of steering. LR records showed 
the MTBF to be 119 ship years for such potential causes of 
loss of steering and a typical time to repair to be 8 days. Both 
these values were taken as the defaults for the marine section 
of the simulation model. 

The anchoring system was taken to comprise the anchors, 
cables and the windlass machinery. Its essential function was 
to hold the vessel at anchor usually in sheltered water e.g. 
awaiting entry to a terminal, against the forces of wind and 
tide. Failure of an anchoring system was not likely to lead to 
a serious loss of anchoring capability. For example, in the 
event of anchor breakage, the weight of additional chain cable 
payed out would compensate for the loss of holding power. 
Also, the second anchor could be deployed, if necessary. In 
general, repair could be carried out whilst berthed at the 
terminal. Consequently, failure of the system resulting in loss 
of functionality was taken to have a value of zero failure rate 
(MTBF is infinite) and was not included in the model. 

Considerable redundancy also existed in the mooring 
system and again repair could be taken to be possible at the 
terminal. Hence the default MTBF was set as infinite and the 
mooring system was not included in the model. 

Damage to any major part of the cargo containment 
systems could result in considerable outage due to the 
complexity of the repair of the systems, however LR’s survey 
records indicated a small number of failures of membrane 
type cargo containment systems (attributable to accidental 
damage or original fabrication deficiencies). Any failure of 
the containment system leading to significant loss of LNG was 
considered to be a negligible event. Very minor defects would 
be detected and rectified during the normal dry docking 
period. Thus, only the more serious defects which would 
normally be detected by monitoring equipment, were consid- 
ered in the marine model. 

Based on the above considerations it was judged that a 
default MTBF for the containment system at least equal to 50 
ship years with a total repair time of 40 days was considered 
to be appropriate. The vessel would off-load its cargo at the 
importing terminal prior to proceeding for repair. All extreme 
accident events (grounding, sinking, collision, fire and explo- 
sion) were excluded from the marine simulation model due 
to their low frequency of occurrence. A brief justification of 
this standpoint is as follows. LR maintains up to date infor- 
mation on all serious recorded casualties. A serious casualty 
is defined as an incident to a ship which results in: 


¢ Actual Total Loss 

¢ Making the ship unseaworthy, such as penetration of the 
hull underwater, extensive structural damage, etc. 

e Breakdown necessitating towage 


Serious casualties are recorded in the traditional way and 
include foundering, wrecking/stranding (including grounding), 
collision, contact, fire and explosion. For this study casualty data 
was examined for a ten year period to look at the frequency of 
occurrence of casualties to liquefied gas ships (a total of 754 
ships at risk). The data yielded an MTBF for serious casualties 
of at least 100 ship years. Clearly, given the extremely good 
safety record for LNG carriers, the MTBF for an LNG carrier 
casualty would be well in excess of this value. Also the simulation 
model would include initiating events which could potentially 
lead to a casualty (e.g. steering gear failure and rudder damage) 
and these events should not be considered twice. 


The marine transportation model rules and logic are 
described in the following discussion. 

The requirement for an empty LNG carrier to load up and 
set out from the exporting terminal was determined from user 
specified monthly send-out and storage requirement. 

The user was required to input a yearly distribution of both 
the monthly average send-out (m*/day) and the monthly storage 
requirement (m’). 

An LNG shipment was triggered when: 


V-Vs= (Send-Out * Delivery lead time) 
(m*/day) (days) 
where: V = Current LNG reserve (m’) 


Vs = Current storage requirement (m*) 


Delivery lead time was defined as the time from order to the 
time of delivery of the LNG. 

This method of requesting a ship approaches actual contrac- 
tual agreements between exporting and importing companies 
without the need for precise dates to be input to the model. 

All delays experienced within each section of the marine 
transportation phase were recorded and applied with appro- 
priate consideration of their consecutive or concurrent nature. 
For example, if two delays occurred at the same time, the delay 
experienced by the ship was the largest of these, although both 
delays will be recorded for reporting purposes. 

Finally the marine simulation model contained definitions 
of rules, inputs and defaults for all data that was relevant to the 
decreased availability of LNG delivery. These are summarised 
here and include the following: 


Chain Definition 

Ship Definition and Ship Failure Rules 

Planned Ship Outages 

Exporting and Importing Terminal Delays: (Berthing, 
Harbour/River Steaming, Pilot Delays, Tug Delays, Tidal 
Delays, Night-time Delays (harbour/river movements of 
LNG are not permitted in the majority of ports out of 
daylight hours), Heavy Weather, Visibility, Mooring and 
associated Connecting-up Delays (which are seasonally 
based). 


3.3.2. Summary 


Itis clear from the information above that extensive knowledge, 
experience and research is required for a simulation of that 
which may at first appear simple. With the exclusion of remote 
events, the more detail available for relatively common occur- 
rences, the more valid the simulation. 

Environmental impact (due to flare or venting) and hazard 
frequency (due to importing terminal failure) could have been 
included directly in this study. However this example is based 
purely on the achievement of a financial benefit (or limitation 
of commercial risk) through optimised operation, i.e. repair 
when demand is low, minimised but effective spares holdings 
and well planned use of resources. The value of simulation in 
calculating the availability of complex interactive systems is 
extremely effective. It provides a low cost solution to theoret- 
ical experiments of systems involving high capital investment. 


4. CONCLUSION 


Each of the case studies presented above is an example of the 
use of AE for safety and/or commercial benefit. 

The safety of a system is a function not only of its design but 
also of its reliability and its maintainability. To divorce these 
availability aspects from safety would invalidate an otherwise 
safe design. Similarly, availability, reliability, and maintainabil- 
ity are vital to the effectiveness of environmental protection 
systems. 

The market for AE will continue to increase due to the pres- 
sures of legislation (for safety and environmental factors) and 
commerce. It is hoped that this brief paper will provide confi- 
dence that the combined and sometimes conflicting demands 
of commercial performance, safety and environmental protec- 
tion can frequently be resolved by the use of AE. 

The Clapham disaster greatly undermined public confi- 
dence in rail travel. The Challenger incident seriously disrupted 
the NASA space programme. Not only were lives lost but the 
viability of the space shuttle programme itself became seriously 
threatened. Yet despite disasters like these man will inevitably 
continue to push technology to its limits. To go forward safely, 
we cannot afford to ignore the experience base and methods 
of Availability Engineering. 
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APPENDIX A: 
HISTORICAL BASIS 


The AE disciplines of Availability, Reliability and 
Maintainability engineering have existed in their basic forms 
for millennia. At no time has man built a system which he did 
not wish to last or be available as required. There has always 
been a desire or pressure to make things durable, for reasons 
which are obvious. Some examples of successful availability 
achievement can be seen in the artifacts handed down by our 
ancestors, the pyramids of Egypt, Stonehenge, the Eiffel Tower 
and Telford’s Menai and Brunel’s Clifton bridges. There are 
numerous examples which could be cited, all of which share 
some of the following design features which have assisted in 
establishing their durability. These features include design 
simplicity (relative to 21st century systems), excessive strength 
in constituent parts, duplication or redundancy of construction 
modules and usually the use of a single material for fabrication. 

Towards the end of the second world war, complex systems, 
involving many different materials and technologies were being 
produced, particularly in the field of military avionics. Space 
and nuclear sectors of industry followed. Equipment miniatur- 
isation and weight reduction, essential to advancing 
technological demands was achieved through the use of solid 
state electronics. The complex functional requirements neces- 
sary for control of both military and space programme systems 
revealed the problem of achievement of the essential availabil- 
ity of this equipment. Early systems suffered from poor 
reliability and excessive fault detection, isolation and repair 
times. The inherent requirement for availability of military 
systems led to the US Department of Defense (DoD) initiative 
which resulted in the formation of the Advisory Group on 
Reliability of Electronic Equipment (AGREE) in 1952. The 
US electronic industries jointly produced a DoD accepted 
AGREE report which advised that systems should be subjected 
to extensive environmental stress testing and that a formal reli- 
ability demonstration should be performed on new equipment. 
The demonstration test provided statistical evidence that the 
new equipment exceeded a predefined Mean Time Between 
Failure (MTBF). The commercial benefits of the AGREE 
approach proved the effectiveness of the defined strategy. 
These benefits were apparent from the savings made in logistic 
support programmes which had previously resulted in exten- 
sive and expensive support personnel training and excessive 
spares holdings. 


The technical details of the methods used for availability 
quantification are included in the following appendices. 
However, it can be noted that Lusser developed the mathemat- 
ical models for reliability prediction, including methods for 
calculation of the reliability of series, parallel and redundant 
configurations. The standard failure rate model is based on the 
fundamental physics of many degradation processes as defined 
in the Arrhenius mathematical model: 


Basic Failure Rate = K exp (=) 
kT 


where E is the electron volt activation energy for the particular 
failure process, k is Boltzmann’s constant, T absolute temper- 
ature and K is constant. It is this equation which is the basis for 
the extensively used reliability prediction handbook MIL- 
HDBK-217 (see Reference 4), where E/k is replaced by a 
constant derived from comprehensive databases of failure 
information. Maintainability features were also quantified, 
through what are termed the “ility” disciplines — accessibility, 
interchangeability, storeability, portability, _ testability, 
detectability, isolatability and repairability — to provide a 
measure of maintenance time, skill level requirements and 
logistic support. Prediction of Mean Time To Repair depends, 
as for reliability, on recorded ‘historical’ data (see References 
7 and 9), 

Quantification of reliability and maintainability has 
produced the strategically required control over a system’s 
availability and is the foundation for AE. The following 
Appendices outline the basic methods on which AE is calcu- 
lated and controlled. 
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APPENDIX B: 
AVAILABILITY 


Availability Engineering integrates the techniques and disci- 
plines of reliability and maintainability engineering as outlined 
in Appendices C and D below. It also interfaces with many 
programme disciplines. It requires programme inputs and 
provides outputs as illustrated below, fig B1. 
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Fig. B1 Interaction of Availability Engineering with other 
Programme Disciplines 


Availability Engineering is an important factor in the achieve- 
ment of system safety and provides a powerful range of 
techniques to support the achievement of commercial commit- 
ments 

Availability Engineering is directly dependent on reliability 
and maintainability engineering and formal mathematical tech- 
niques are used to relate their output. 

Mathematically, steady-state system availability can be 
determined from the ratio of Mean Time Between Failure and 
the sum of Mean Time Between Failure plus Mean Time To 
Repair 1.e. 


Availability (A) = MTBF/(MTBF+MTTR) 


The following diagram (fig B2) illustrates the way that AE 
interacts with and should be considered to be an integral part 
of programmes that are concerned with safety or commercial 
viability. It summarises the general approach that is taken in 
AE strategies and, though basic, is consistent with the economic 
use of AE resources. 
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The reliability and maintainability plans discussed above are 
united in an Availability Engineering approach to provide the 
most resource-effective solution. The Techniques included in 
the availability plan are selected from those outlined in 
Appendices C and D below for R&M, as required by contract, 
and as necessary to achieve design aims. Naturally, overlap or 
repetition of effort is avoided in task selection. 


Allocate 


(Specify ARM&S also) 


Design 
Solution 


Functional 
Requirements 


ARM&S achieved 


Fig. B2 Example of Interaction of Availability Engineering 
and Design/Development Programmes 


APPENDIX C 
RELIABILITY 


Reliability is the probability that an item will perform a 
required function, under defined conditions, for a stated period 
of time. It is the probability of conformance to a specification 
(the definition of quality) for a given time. All systems (apart 
from software) exhibit what is referred to as a ‘bathtub’ rela- 
tionship between the probability of failure and time, as 
illustrated below in fig Cl. Software is subject to the ‘infant 
mortality’ portion of the curve but does not exhibit wear-out, 
as is the case for hardware. Quantification and control of the 
reliability of software during the ‘random failure’ phase is the 
subject of intense research at this time. 
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Fig. Cl Bathtub Curve 


For repairable (replaceable) hardware systems, which are 
the general case in industry, it is observed that an approximately 
constant failure rate exists during the ‘random failure’ phase 
and from this it follows that the observed time dependence of 
reliability may be expressed as: 


R(t) =e* 
(where A is the failure rate) 


There is in reality no such thing as a random failure. Clearly that 
which appears to be a random failure is a straightforward reflec- 
tion of our basic and inescapable ignorance of the intrinsic 
design and production defects or weaknesses. Total control over 
‘randony’ failures is not feasible. Obtaining the detailed level of 
knowledge related to both the materials used and construction 
processes is not possible due to constraints such as time, cost, 
practicality and capability. It is however possible to limit the 
variability of the production process through statistical process 
control. Genichi Taguchi identified that there existed control- 
lable production features and associated production ‘noise’ and 
developed methods to limit product variability. The relatively 
immature subject of software reliability started from the 
premise that its reliability could be controlled and predicted by 
methods analogous to those used for hardware. Hardware reli- 
ability prediction is based on the principle that the future 
reliability of a system can best be estimated from historical data. 
Both software and hardware are man made systems that are 
equally subject to design or production flaws. It is therefore 
probable that both will display a constant failure rate. 
However each software product is, in general, distinctly 
different from previous developments and therefore cannot, in 
general, depend on historical databases for derivation of relia- 
bility constants. The value of research programmes such as 
FASGEP. which is in part funded by LR, is therefore significant 
because it addresses the problem of software development 
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process variability. The aim of the FASGEP programme is to 
develop a method for prediction of levels of confidence in the 
reliability of software: it will achieve this by identification of 
error introduction mechanisms and quantification of their prob- 
ability for each stage in a generic software development life 
cycle. 

It is clear that the reliability of any system is BUILT-IN 
during, and is nota BY-PRODUCT of the initial definition of 
the functional requirements, the development of the system’s 
specification, and the subsequent design, development and test- 
ing. This is valid for any structure or system containing 
mechanical, electro-mechanical, electronic or software 
elements. Building in reliability requires investment and it is 
vital that the investment be cost-effective. It is therefore impor- 
tant that trade-off studies are performed which take into account 
the costs of factors such as increasing component quality, stress 
derating, manufacturing processes, test, safety, classification 
requirements certification requirements, market pressures, 
legislation, development risk, warranty, maintenance and logis- 
tic support. 

Reliability Engineering (RE) methods have been developed 
and refined through years of application to meet the demands 
of industry and this process is continuing. Reliability 
programmes are prepared by the selection of techniques which 
are appropriate to a specific programme of work in hand. The 
following list identifies some of the ‘tools’ which are available 
to a reliability engineer: 


¢ Reliability Programme Definition, Implementation and 
Control 

¢ Mechanical, Electro-Mechanical, Electronic and Software 

Reliability Design Appraisal 

Reliability Modelling 

Reliability Allocation, Analysis and Assessment (AAA) 

Stress Derating 

Failure Mode, Effects and Criticality Analysis (FMECA) 

Fault Tree Analysis (FTA) 

Human-Machine Interface (HMI) Reliability Assessment 

Software Reliability Methods 

Testability Requirement Analysis 

Operational Simulation 

Sneak Circuit Analysis (SCA) 

Markov Analysis 

Burn-in, Environmental Stress Screening (ESS) or Run-in 

Test 

Qualification and Verification Test Programmes 

¢ Reliability Growth Assessment 

¢ Data Recording and Corrective 
(DRACAS) 


Action Systems 


Such techniques provide design visibility and serve to identify 
areas which may represent a degree of risk or compromise to 
the system’s reliability. The methods are formal, comprehensive, 
objective and intended to be implemented in the design process 
from the earliest stage onwards. 

It is possible to identify those areas in existing plant, where 
an improvement in reliability parameters will result in a signif- 
icant increase in availability or a decrease in Hazard Rate. By 
tailoring the effort spent on reliability enhancement to match 
the requirements of the plant or equipment, it is possible to 
arrive at the most cost and resource effective solutions to design 
targets. Quantification of this process is discussed in Appendix 
E. A brief description of each of the methods listed above is 
given to provide an overview of general reliability engineering 
techniques. 
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Fig. C2 Reliability Block Diagram Associated with an LNG Importing Terminal 


¢ Reliability Programme Definition, Implementation and 
Control 


This is particularly relevant to those plants or systems where 
the achievement of safety and availability targets is mandatory. 
A detailed definition of reliability qualitative and quantitative 
requirements together with a pre-planned strategy to achieve 
those targets is provided ina programme plan. The Plan ensures 
that all aspects of plant life-cycle are considered and that work 
performed under the reliability programme is consistent with 
other related design, development and production functions. 

The defined programme of work is implemented and 
reported in a manner which maintains the visibility of its impact 
on the system design. Controls, required by the reliability 
programme plan, are applied to the design process as specified 
and as derived from analyses. 

The major benefit of this approach is that visibly coherent 
effort is directed to the task of designing in a predefined level 
of reliability. 

The extent of a reliability programme plan is always tailored 
to meet system requirements and frequently forms part of a 
unified approach to safety, availability and maintainability. A 
reliability programme plan is a contractually binding definition 
of work to be performed to achieve specified design require- 
ments, 


¢ Mechanical, Electro-Mechanical, Electronic and Software 
Reliability Design Appraisal 


STD have techniques to estimate the level of reliability that is 
compatible with a systems design and function. These appraisal 
methods are based on the use of checklists specifically compiled 
for mechanical, electro-mechanical, electronic and software 
functions —in particular industrial applications. Further assess- 
ment of intrinsic features is achieved by identifying the degree 
of similarity between the system to be appraised and those for 
which well substantiated information exists. Data for the docu- 
mented systems is weighted to take into account such factors 
as technology, environment and complexity to provide an indi- 
cation of the systems reliability parameters. 

Design appraisal provides a rapid picture of general design 
acceptability in terms of reliability, and may also be used to 


track a system’s reliability changes. Quantitative design 
appraisal may also be used to provide or justify early specifi- 
cation requirements for a system’s proposed hardware and/or 
software and to indicate the degree of compliance with such 
requirements. Example checklists are included in 
Appendix B. 


¢ Reliability Modelling 


Reliability Modelling is an essential part of any unified 
approach to safety, availability, reliability and maintainability. 
The method breaks a system structure into its elementary func- 
tions or reliability blocks to identify those areas where a process 
may be considered serial or parallel and whether redundant 
elements exist. Based on the derived model it is possible to 
quantify reliability parameters and those functions having the 
most significant impact on system reliability. An example 
Reliability Block Diagram (RBD) is given in fig C2. 

System reliability may be allocated and assessed in a rela- 
tively straightforward manner where the system’s reliability 
blocks are independent of each other although this process is 
frequently supported by other software tools. When this is not 
the case and lowest level functions are necessarily interactive 
and/or time dependent then STD adopt system simulation tech- 
niques. The models generated provide the input to several other 
processes performed as parts of an integrated Availability 
Programme, eg. FMEA, FMECA, FTA, Spares Requirements 
Analysis, R&M Prediction and Testability Analysis. 


¢ Reliability Allocation, Analysis and Assessment 


Reliability Allocation, Analysis and Assessment (AAA) is the 
method by which a plant or system’s specified reliability param- 
eters are: 


¢ Apportioned to each function — based on the reliability 
block diagram data 

e Analysed through a reliability and stress prediction 

e Assessed through a Data Recording and Corrective 
Action Scheme (DRACAS), FMEA output, FTA output 
and other sources of reliability information (e.g. Test and 
Field data) 


The process provides for the controlled achievement of 
specified reliability targets through a ‘design to requirement’ 
approach, followed by analysis and assessment to confirm 
compliance or to provide early indication of areas of 
concern. 

The procedure is achieved by apportioning specified reli- 
ability parameters to areas or reliability blocks previously 
identified during the reliability modelling exercise (taking 
account of design redundancy). 

The reliability of these blocks, and of the system is then 
assessed using methods which are based on data derived 
from past experience thus ensuring that no potential prob- 
lems exist which would prevent the system achieving the 
specified reliability. Due to the ‘historical’ nature of the 
system data on which reliability prediction methods are 
based, it is essential that the impact of quality control meth- 
ods, new technologies for manufacture and _ the 
risk/reliability of new technologies is included in the predic- 
tion. It should also be noted that the validity of any hardware 
reliability prediction is dependent on the expertise and expe- 
rience of the analyst. 

This process allows early identification of, and corrective 
action to, areas of design that may be non-compliant. Where 
asystem’s model involves a complex interaction of reliability 
blocks, reliability is assessed using discrete, continuous or 
Monte Carlo simulation methods, taking account, where 
necessary of time dependency or probability distributions. 

To provide further confidence in the parameters used, 
data derived from early tests on the system may be used to 
assess the observed reliability. Data used for this process is 
usually controlled in a closed loop reporting system to ensure 
that all faults are analysed as to their cause and the appro- 
priate corrective action taken. 

The AAA procedure provides detailed information for 
Failure Mode, Effect and Criticality Analyses (FMECA) 
and Fault Tree Analyses (FTA). 


e Stress Derating 


The process of stress derating or over-engineering is well 
established in all sectors of industry, but is particularly 
evident in mechanical industries such as ship or bridge build- 
ing. The intuitive approach of exceeding strength 
requirements to provide safety, reliability and availability is 
justifiable. Reliability Engineering adopts the same 
approach whether the system, or sub-system is mechanical, 
electro-mechanical or electronic. It is an important process 
in the improvement of a system’s reliability. As part of a reli- 
ability programme strategy, the levels of cost-effective stress 
derating are planned, quantified and validated. The levels 
are based on historical, thermal, stress and duty-cycle infor- 
mation. The process is applied to every system item whether 
it be a soldered joint, transistor, microprocessor, connector, 
actuator, mechanical interface or other mechanism. 

Stress Derating reduces the probability of failure of 
marginal components and reduces the effect of parameter 
variation or drift. The level of stress derating whether elec- 
trical, thermal or mechanical is included in the calculation 
of predicted failure rate. The method is not intended to 
provide protection against transient stress surge as this 
should be covered by inclusion in the design specification of 
mechanisms to absorb the energy involved in switching, elec- 
tromagnetic interference and other extremes of dynamic 
energy associated with a change of state. 

Quality assurance methods interact with the process of 
stress derating by ensuring that the system is made of parts 
of appropriate quality suitable for the functional demand 
placed on them. 


e Failure Mode, Effects and Criticality Analysis 


A Failure Mode and Effects Analysis (FMEA) isa design anal- 
ysis technique which examines the effect(s) of a single point 
failure to establish the subsequent effect on the system as a 
whole. The process provides a disciplined environment for the 
detailed examination of the effects of a failure of acomponent 
in the system. This procedure forces an objective identification 
of the effects of a system failure and may be extended to include 
multiple failures. Data from an FMEA provides direct feed- 
back to development engineers on possibly unforeseen 
consequences of various system failures. FMEA output may 
also be used in the preparation of maintenance documenta- 
tion. 

A Failure Mode, Effects and Criticality Analysis (FMECA) 
is an extension of an FMEA to include the criticality of a fail- 
ure. Mode frequency may be derived theoretically or may be 
based on past experience; criticality is usually given a numer- 
ical index to indicate the extent of damage associated with a 
particular failure. On completion, a matrix of frequency 
against criticality is produced so that the effects of failures with 
relatively high frequency and criticality can easily be identified 
and the appropriate design changes initiated. 

An FMECA provides direct feedback to design/develop- 
ment engineers and may be used to assist in the generation of 
maintenance documentation, as an FMEA does. FMECA 
however, also provides direct information on the significance 
of safety critical single point failure modes. FMECA informa- 
tion may readily be used to derive the frequency and extent 
of maintenance tasks, and the effectiveness of Built in Test or 
Condition Monitoring capability. 

An FME(C)A is a bottom up analysis which may start at 
any level of indenture to derive the system effect; in this way 
it may be tailored in depth and cost to match the system 
requirement. An FME(C)A is particularly useful in the iden- 
tification of faults in a system which are at the time of the 
analysis unrevealed. The FME(C)A is an appropriate tool for 
the improvement and assessment of both safety and availabil- 
ity. It is intended for use early in a system's life cycle and 
provides feedback to design or process authorities on actual 
or potential problems. For this type of analysis this is the most 
cost effective point in the total life of the system. 

Clearly, data derived from both an FMEA and an FMECA 
can be used to improve system reliability, maintainability, 
availability and safety. STD’s approach to FME(C)A is based 
on a clear definition of all the ‘ground rules’ involved in order 
to remove, as far as possible, elements requiring subjective 
judgement. 

The analysis makes extensive use of STD’s software to 
control and analyse the large amounts of information 
involved, and to provide ‘spin off’ data relating to testability, 
the frequency of any predicted event and data indicating the 
most probable causes of particular failure effects. 

Failure Mode and Effects (and Criticality) Analysis is an 
extremely effective tool which in the author’s experience is 
frequently undertaken after the design process has been 
completed and is carried out purely to meet contractual docu- 
mentation requirements. When correctly undertaken it is 
intended to provide an objective and comprehensive evalua- 
tion of a proposed system design. When performed in a timely 
manner as an integral part of the design process it can signifi- 
cantly reduce design errors and provide an insight to the 
system's viability, reliability, maintainability and availability. 

The FMECA process is applicable to hardware design, 
software design, integrated systems and systems where human 
error could be significant. An example FMECA analysis sheet 
— based on the guidelines of MIL-STD-1629A is included in 
fig C3. 
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¢ Fault Tree Analysis requires a detailed knowledge of environmental conditions, 


Fault Tree Analysis (FTA) is a ‘top down’ analysis process 
whereby high level system events are studied to determine the 
fault(s) or combination of faults which would cause the high 
level event to occur. The method is extremely useful in risk limi- 
tation and criticality assessment of both hardware and software, 
and enables reliability engineers to accurately identify areas of 
the design for which redundancy of function is essential to total 
achievement of specified reliability. 

Criticality of software or hardware is calculated from 
frequency data for base events. Frequency information for 
hardware is available from many sources including Lloyd’s 
Register’s casualty data and surveyor reports. Software base 
event frequency data may be derived from a software model, 
selected for its consistency with the particular design under 
consideration. However, the software reliability assessment is 
far more problematic than the parallel hardware exercise and 
for this reason software FTA is usually limited to a qualitative 
study of top event causes. 

STD makes extensive use of dedicated support software for 
FTA data handling. This enables the logical interrelationships 
between base events to be studied, allows rapid analysis of 
results and eases the process of presentation by providing a 
readily understandable format. 
¢ Human-Machine Interface Reliability Assessment 
Reliability of a Human-Machine Interface (HMI) is controlled 
and assessed at two levels of detail. At each level the extent of 
the effort spent is matched to the scope of the requirement. 
HMI reliability control is essential to a sound and safe design 
which will not degrade a plant or system’s intrinsic reliability. 
For these reasons HMI reliability control should be considered 
and designed into the plant or system, at an early stage. 

HMI reliability characteristics are assessed at the highest 
level by means of human engineering checklists which test for 
features with proven impact on HMI response success. The 
checklists are based on sound engineering principles and 
include experience gained from Lloyd’s Register’s surveyor and 
casualty reports. If applied at an early stage in the development 
process, HMI reliability characteristics are able to significantly 
influence the overall reliability of a plant or system. 

A deeper approach to HMI Reliability control is provided 
by a detailed analysis of all HMI tasks. The target of this 
approach is to increase plant safety and availability through a 
comprehensive analysis related to the removal of the possibility 
of ‘human error’. The methods used incorporate FTA and 
Event Tree Analysis (ETA). (ETA studies the effects, over 
time, of an initiating event.) This approach to HMI control 


user skill levels and organisational information. 

Removal of ‘human error’ from the list of reasons for a 
system’s failure, usually requires that a high degree of testability 
be built into the system, and that as far as possible the system 
is automated. HMI reliability, involves design testability and 
software reliability assessment and control. 


¢ Software Reliability Control 


The general approach to software reliability is based on design- 
ing in reliability through the implementation of an appropriate 
software quality assurance programme. None of the numerous 
proposed methods for software reliability quantification have 
received general acceptance. Guidelines for achievement of 
integrity, particularly in the case of safety critical software, 
provide a basic framework for control of the software develop- 
ment process. 

A large range of support tools exist for both static and 
dynamic testing of software. Testing can only provide a degree 
of confidence in the integrity of the software. It is seldom possi- 
ble to prove that no faults exist. 

As is the case with hardware, reliability must be built-in and 
formal methods are evolving to achieve this. The methods are 
based on mathematical logic, developed to allow reasoning 
about the discrete processes that are an intrinsic feature of 
computer systems. An analogy to this approach is the theorem 
of Pythagoras (see Reference 3). In theory a degree of confi- 
dence in its validity could have been derived by extensive 
testing and use. However, the elegant Euclidean proof of its 
validity removes the need for testing and visibly validates its 
integrity. 

A further approach to achieving confidence in software 
integrity is based on a process of Verification and Validation 
(V&V). The validation process ensures that at any stage in the 
software development life cycle a software product is exactly 
as required by specification. The verification process attempts 
to ensure that all software products that are developed during 
the life-cycle of software generation are compatible. The V&V 
method seeks to achieve integrity through inspection for prod- 
uct completeness, consistency, and accuracy. 

LRID provide an Independent Verification and Validation 
(IV&V) service to certify the adequacy of software for its 
purpose. There are, naturally, limits to the adequacy statement 
that can be made for any software. 


¢ Testability Requirement Analysis 


Plant hardware and software testability is essential if confi- 
dence in the integrity and safety of the operation is to be 


achieved. Testability cannot easily be added to a system follow- 
ing design and is normally achieved by building in defined 
detection and isolation capabilities. 

High levels of testability enhance plant reliability through, 
controlled handling of potential failures. 

Assessment of testability is achieved through quantitative 
and qualitative techniques. Qualitative approaches rely on the 
identification of the various functions within a system, coupled 
with an assessment of the testability of each function. 
Quantitative assessment is performed as for a qualitative 
assessment but includes frequencies and probabilities of 
success of faults and tests to permit better evaluation of testa- 
bility. 

A testability analysis is most efficiently performed when 
combined with an FMEA or FMECA to provide qualitative or 
quantitative data respectively. 


¢ Operational Simulation 


When systems, as derived from Reliability Block Diagrams are 
simple in terms of functional interaction it is possible to quantify 
reliability through analytical techniques based on algebra, 
calculus and probability theory. Frequently systems are 
extremely complex with intricate functional interaction and in 
these cases reliability is calculated by simulation using a 
computer based model to mimic the system. 

The model contains all available information on the system's 
function and the reliability of the individual components and 
isrun repeatedly using randomly derived input parameters. The 
need for repetition is due to the increasing mathematical confi- 
dence that results from a large number of observations. The 
technique allows ‘what if?’ questions to be answered to provide 
data on the effectiveness of different design solutions. 

This powerful approach to AE provides a considerable 
insight into interactive mechanisms and real world perfor- 
mance of a plant or system. 


¢ Sneak Circuit Analysis 


Sneak Circuit Analysis (SCA) is a method for the detection of 
unintended design paths through a system. These paths are not 
system failures but may exist in complex systems through 
incomplete analysis or specification of the total design. 

Sneak Circuits can exist both in hardware and software and 
by their nature become apparent infrequently and only when 
a particular combination of circumstances exist. 

It is considered that they may form the basis of many “No 
Fault Found’ failures or those which are sometimes attributed 
to operator error. 

The effect of a ‘Sneak Circuit’ could certainly impact on a 
system’s function and could effect its reliability. 

The fundamental methods for SCA were originated by the 
Boeing Aircraft Corporation who also developed the support 
software for this complex system design analysis task. The avail- 
ability of support software has recently been extended by 
several AE support engineering companies. 

Itis also worth noting that the probability of ‘Sneak Circuits’ 
existing in complex systems is greater, due to their complexity 
and increased probability of specification or design error. The 
application of SCA should be considered in such cases and its 
use will be dependent on the outcome of risk-cost trade-off. 

There are five recognised types of ‘Sneak Circuit’, the first 
two are displayed when a fluid, gas or electrical current flows 
along an unintended route — or fails to flow along an intended 
path. The third manifests its presence when flow does not occur 
at the correct time or does so at the wrong time. The fourth and 
fifth types are related to an indication of data; of these the first 
is an internally incorrect status data message and the second an 


external message which is incorrect or ambiguously repre- 
sented. 

The effects of these design faults are frequently assigned to 
system failure or lack of reliability and range from trivial to 
catastrophic. It is for this reason that SCA is considered to be 
essential in the design integrity assessment of complex systems 
or designs. 


¢ Markov Analysis 


Markov Analysis is a useful tool for dealing with complex 
systems for which components can, with a defined probability 
be in one of two states either functional or non-functional (i.e. 
failed). The Markov process uses the defined probabilities of 
this change of state to build a state transition diagram. The 
process can take account of the repair of parts of the system 
and though intricate for complex systems, is a useful and effec- 
tive tool for reliability calculation. 

Asa basic example of what might be considered, where tran- 
sitions from operating to non-operating states are given 
together with the probabilities of remaining in functional or 
non-functional states: 


Failed 
State 
Condition 


Fully 
Functional 


Condition 


1-Paf 1-Pfa 


where Paf = probability of state change from available to failed 
and Pfa = probability of state change from failed to available. 


This approach can be extended to complex systems, and with 
the support of matrix theory based software, can be used to 
derive the probability of a system being in any state at any time. 


e¢ Burn-in, Environmental Stress Screening (ESS) or Run- 
in Test 


Burn-in, Environmental Stress Screening (ESS) or Run-in Test, 
which for brevity will be referred to as ESS, is a production 
process which is designed and planned to remove the weak- 
nesses associated with manufacturing defects, inspection 
deficiencies and general defects that are associated with newly 
manufactured systems. 

The ‘Bathtub’ curve illustrated earlier in this section indi- 
cated the well demonstrated principle that the probability of 
failure is not constant. Systems have an increasing failure rate 
as they approach wear-out, unless controlled by a maintenance 
programme. They also exhibit a relatively high but decreasing 
failure rate following manufacture due to the existence and 
removal of early life weakness. It is possible to limit the effects 
of ‘infant mortality’ by screening, testing or over stressing new 
systems. 

The approach is appropriate for dynamic systems, including 
software, where stress testing provides evidence and the oppor- 
tunity to remove production weakness. The process is planned 
to provide sufficient stress to systems under test to simulate and 
exceed the stresses associated with intended functional envi- 
ronments. Removal of this ‘infant mortality’ part of the life 
cycle provides extensive financial and safety benefits. It also 
highlights weaknesses in the manufacturing process. 

When planning ESS it is clearly important that systems are 
neither under nor over stressed. Therefore the Burn-in, ESS or 
Run-in test regime, cycle duration and number must be care- 


fully calculated to present sufficient but not excessive stress. It 
is also important that failure data is analysed and recorded. The 
benefits of this technique are well proven and particularly rele- 
vant to. safety critical systems, whether mechanical, 
electro-mechanical or electronic. 

The typical results of an ESS scheme involving these systems 
is presented below, see fig C4. It is based on a sub-system of the 
General Dynamics F-16 fighter aircraft. The record consists of 
ESS cycle number and faults found. 

An essential part of ESS planning is involved with the extent 
of re-testing which will be necessary following the repair of a fault 
condition. This is due to the added complication that areas of a 
partially screened system are new and have been subjected to re- 
work. 


e Test and Verification Programmes 


Test requirements are derived on a case by case basis from an 
examination of a plant or system’s function. They are designed to 
provide a predetermined degree of confidence in the capability 
of plant or system to perform its intended function. 


Reliability tests are targeted at those items of hardware for 
which performance verification is essential, due to their criticality, 
accessibility or availability requirements (see References 2 
and 15). 

Software testing is, in general, planned to remove design faults 
and provide confidence in functional capability. 

Test and verification programmes are usually subject to 
contractual agreementas they frequently form the basis for accep- 
tance of systems. It is therefore important that they are well 
defined, adequate, planned and documented. An example of a 
typical test cycle which would form part of a reliability qualifica- 
tion programme is shown overleaf in fig CS. 

Reliability testing is essential for those items which may be 
classed as safety critical. Verification may be achieved at an 
acceptable cost and within the schedule limitations by means of 
a statistically determined accelerated simulated life test 
programme. The cycle shown above represents an acceleration 
of life through thermal cycling, application of three axis random 
vibration and power switching. 


¢ Reliability Growth 


40.0 - Reliability Growth of systems occurs through the natural process 
of removal of the weak areas of a design that are discovered during 
use,and can apply to any system. 

J T Duane observed an empirical relationship between rate 
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Fig. C5 Reliability Qualification Programme Test cycle 


¢ Data Recording and Corrective Action Systems 


Data Recording and Corrective Action Systems (DRACAS) 
are fundamental to Reliability Engineering and provide the 
method for control, analysis and reporting of information 
relating to failures. 

An important feature of their use is that they provide a 
mechanism to ensure that failures are analysed and resolved 
and for this reason are often referred to as closed loop systems. 

Trend analysis is performed on data held by DRACAS to 
allow: 


Evaluation of Reliability Parameters 

Comparison of predicted and in-use data 

Early identification of potential problems 
Management visibility of system performance 
Warranty Management 

Warranty, Financial Incentive and Financial Penalty 


The use of Warranties, Incentives or Penalties in reliability 
engineering has been common practice within the military 
sector for many years. This is due to the importance of reliability 
and availability in military systems. The process is rapidly 
spreading to other sectors. 

Warranties force manufacturers to think in the long term 
and not limit their efforts to the achievement of a system's initial 
acceptance. They also address the cynical attitude that can in 
some instances consider that the producer has more to gain by 
building in unreliability and hence increasing sales of spares. 


The use of a financial penalty as a means of gaining confi- 
dence in long term reliability is the least popular approach due 
to the negative effect that it has on the relationship between 
client and producer. Incentives provide a far more positive 
approach and the basic concept is explained in fig C6. 

A fairly new approach to the use of incentives, and one that 
is becoming more popular is the Reliability Improvement 
Warranty. This is based on the payment of a single fee by the 
client to cover all spares and repairs for an agreed period of 
time. It is naturally in the producer’s financial interest to ensure 
that demands placed on him are low and hence that system reli- 
ability is adequately high. 
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Fig. C6 Contractor Profit Motivation 


APPENDIX D 
MAINTAINABILITY 


Maintainability is the probability that a failed system will be 
restored to full conformance with the specification within a 
defined period of time. It is the probability of repair within a 
stated time. 

As is the case with system reliability, effective maintenance 
is a design feature which is built-in and is not a by-product of the 
development process. System maintenance can be expensive and 
is frequently overlooked in terms of its impact on the running 
costs of a system. The capital investment in logistic support, 
spares holdings, the cost of ‘downtime’ and the cost of repair 
have a significant impact on a system’s commercial viability. 

Maintainability engineering can impact on a system's safety 
by the removal at the design stage of parts of the system which 
have a high maintenance load. Here the relevance of the ‘ilities’ 
mentioned in Appendix A are important in influencing the 
design process. These include: 

Accessibility A measure of the effort required to gain 
access to a failed part 

Form, fit and function compatibility of 
spares 

The probability that a stored spare will 
conform to its specified function after a 
defined period of storage in a specified envi- 
ronment 

A measure of the effort required to safely 
transport a spare from storage to its point of 
installation 

A design feature to allow user to validate the 
integrity of the system following repair 
The probability that a failed item will be 
detectable and not remain as a_ latent, 
dormant or unrevealed fault 

The probability that a detected fault will be 
correctly isolated to the failed item 

An overall measure of the ability to restore 
a failed system to specification 


Interchangeability 


Storeability 


Portability 


Testability 


Detectability 


Isolateability 


Repairability 


Maintainability Engineering (ME), whichis a formalised exten- 
sion to conventional engineering practice, provides improved 
visibility and containment of required maintenance resources. 
When applied by experienced ME engineers it inevitably saves 
money and more importantly addresses the risks associated 
with incorrect maintenance. 

Planning the most effective maintenance strategy, includes 
consideration of the relative benefits of preventative (sched- 
uled) or corrective (on-demand) maintenance strategies. 

Planning for minimised system ‘down-time’ includes consid- 
eration of corrosion prevention, tolerances which allow for use 
and wear throughout life, support tool requirements, skill level 
requirements, reduced complexity (and cost) of maintenance, 
logically sequenced tasks, handling, storeability, re-calibration 
requirements, design for self-test (condition monitoring), soft- 
ware maintainability, maintenance location — planning, 
optimised spares holding ... as examples. 

Specification, definition and quantification of maintenance 
provides an increased level of control over investment in 
systems. The process is most effective when integrated with 
development programmes. 

The processes of ME can also be applied to existing systems 
to decrease ‘down-time’, skill level requirements, the cost 
burden of spares holdings and the potentially hazardous situa- 
tions that can result from system maintenance activities. 

Apart from the quantifiable detail (testability, skill level etc) 
which can be applied, the Maintainability of a system is 


expressed in terms of two basic parameters. These are the Mean 
Time to Repair (MTTR) and the Maximum Maintenance Time 
(Mmax). The requirement for both of these parameters is due 
to the fact that maintenance time usually exhibits a log-normal 
distribution. 

However, the principle parameter that is specified is MTTR 
which can be calculated by dividing the total time that the 
system is “off line” by the number of breakdowns, i.e. 


S(ALi].[i]) 
S(Mil) 


(where t[i] is the repair time for the ith sub-system) 


MTTR = 


The tools that are available to the Maintenance Engineer to 
support the derivation and control of asystem’s MTTR include 
the following: 


* Maintainability Programme Definition, Implementation 
and Control 

¢ Mechanical, Electro-Mechanical, Electronic and Software 
Maintainability Design Appraisal 

¢ = Maintainability Modelling 

¢  Maintainability Allocation, Analysis and Assessment 

Failure Mode, Effects and Criticality Analysis — 

Maintainability Information 

Quantitative Maintainability Task Analysis 

Human Factors Maintainability Assessment 

Software Maintainability Assessment 

Testability Requirement Analysis 

Operational Simulation 

Maintainability Test and Verification Programmes 

Data Recording and Corrective Action Systems 

Warranty, Financial Incentive and Financial Penalty 


Many of these tasks parallel the reliability engineering effort. 
The following summaries of the maintainability programme 
tasks will emphasise the areas where significantly different 
approaches are taken. 


¢  Maintainability Programme Definition, Implementation 
and Control 


Used in the same manner as a reliability programme and often 
combined with a reliability plan the document forms part of a 
contract. It defines all maintainability related design goals, 
which may include: 


Maintainability Design 

Maintenance Policy 

Repair Levels 

Mean Time To Repair 

Maximum Time To Repair (at a defined confidence level) 
Fault Detection Capability 

Fault Isolation Capability 

Interchangeability and Accessibility Requirements 
The Effects of Storage and Transport 

Mean Maintenance Man Hours (per year) 
Maintainability Demonstration 


Each of these items, and others, are defined in the maintain- 
ability programme together with the methods to be used to 
achieve them. The plan is subject to contractor or client 
approval. 


¢ Mechanical, Electro-Mechanical, Electronic and Software 
Maintainability Design Appraisal 


This effort is part of the ongoing process of design appraisal 
and verification. It provides output to the Quantitative 
Maintainability Task Analysis and the DRACAS system. 


¢  Maintainability Modelling 


Maintainability modelling identifies the series of activities 
required for maintenance tasks, the skill level requirements, 
the tools needed and the time required. Information from this 
activity may readily be used to define plant maintenance proce- 
dures, and generally forms an essential component of the 
iterative process of plant availability optimisation. 

The models generated provide the input to several other 
processes performed during a total maintainability programme 
which include maintainability prediction, FMECA — maintain- 
ability information, spares requirements and Testability and 
Logistic Analysis. 


¢  Maintainability Allocation, Analysis and Assessment 


This process, as for reliability AAA, provides the visibility and 
control of the design necessary for the achievement of contrac- 
tually specified Mean and Maximum Maintenance Times. 

MTTR figures are allocated to sub-systems in such a way 
that overall system MTTR is achieved. The design is analysed 
(as described in MIL-HDBK-472) by summing the individual 
maintenance action times for each sub-system to give Ts(i). The 
mean time to repair is then calculated using the formula previ- 
ously outlined: 


_ S[TS(i).A(i)] 
= [A(i)] 


MTTR 


e Failure Mode, Effects and Criticality 
Maintainability Information 


Analysis — 


This analysis is performed as defined in Task 103 of MIL-STD- 
1629A to provide information on the probabilities of different 
failures having the same effects on the system. For computer 
based FMECA it is a trivial sorting of the data provided for 
reliability based FMECA and provide valuable information for 
system diagnostics. For example, for any given system failure 
effect it is possible to quickly find all possible causes and the 
most probable cause. 


¢ Quantitative Maintainability Task Analysis 


This is an extremely basic maintainability analysis method 
which reviews the maintenance actions in detail. For each task 
the process of gaining access to the failed sub-system is 
reviewed and every step recorded, together with the time taken, 
tools required, number of maintenance staff and skill level 
required and any problems or potential hazards encountered. 

It is an exhaustive task which provides extensive informa- 
tion to all parts of a maintainability programme. It naturally 
produces valuable input for maintenance manuals. It also 
serves to identify those areas where a design change could 
significantly impact on maintenance time and hence system 
availability. 


¢ Human Factors Maintainability Assessment 


HMI assessment and control, (as described under the section 
on Reliability Engineering) is of particular benefit to plant 


maintainability programmes and can provide a major benefi- 
cial impact on safety, ease of maintenance, complexity, tool 
requirement and the time for both scheduled and unscheduled 
maintenance actions. By adopting a controlled approach to 
HMI maintenance aspects it is possible to ensure that mainte- 
nance actions do not adversely impact the system’s safety and 
reliability. 


e Software Maintainability Assessment 


Software maintainability, in general, is achieved as part of a 
software quality assurance programme. At a high level, it 
consists of procedures to ensure that all code produced meets 
the defined standards of structure and documentation. 


e = Testability Requirement Analysis 


High levels of testability provide extensive savings in system 
maintenance time through rapid detection, isolation and repair 
of failed items. For electronic or computer based control 
systems the inclusion of self-test and built-in test systems with 
specified detection and isolation capabilities is fundamental to 
this process. 

This process has been extended through condition moni- 
toring methods which are also applicable to mechanical 
systems. 

As for reliability, assessment of testability is achieved 
through quantitative and qualitative techniques. Qualitative 
approaches rely on functional identification and testability for 
each function and include consideration of degraded test capa- 
bility through multiple failures. Quantitative assessment is 
performed as for a qualitative assessment but includes 
frequencies and probabilities of success of faults and tests to 
permit better evaluation of testability. 

A testability analysis is most efficiently performed when 
combined with an FMECA to provide qualitative or quantita- 
tive data respectively. The output of a testability analysis and 
the testability requirements themselves may be verified as part 
of a maintainability demonstration test. 


¢ Operational Simulation 


The inclusion of maintainability data, repair times and distri- 
butions in simulation models developed for reliability 
engineering, usefully extends the model to allow for an assess- 
ment of the system’s availability. 

It also makes it possible to verify the projected spares hold- 
ings and the valuable ‘what if?’ approach to the trade off of 
reliability, maintainability, investment and availability. 


¢ Maintainability Test and Verification Programmes 


This is a useful technique for maintainability design validation 
and is usually based on methods described in MIL-STD-471. 
It provides a high level of confidence in the achievement of 
both quantitative and qualitative maintainability programme 
requirements. 

The client is given an extensive list of possible system faults 
which are usually derived by a random failure rate weighted 
method. With maintenance staff absent, the client selects a 
fault and it is simulated on the system, leaving no visual clues. 

The maintenance staff are then invited to check and repair 
the system. Times taken for detection, isolation, gaining access, 
removal, replacement, rebuild and functional test are recorded 
as are any faults that occur, for example incorrect isolation. 

The process is repeated many times and the results statis- 
tically analysed to assess design compliance. 


‘ 


¢ Data Recording and Corrective Action Systems 


As in the reliability engineering approach, the DRACAS 
system provides a closed loop control for any maintainability 
related problems. 


¢ Warranty, Financial Incentive and Financial Penalty 
Design Maintainability features become part of warranty 


programmes when combined with Reliability in an Availability 
warranty. The incentives discussed under reliability apply. 


APPENDIX E 
COST - BENEFIT 


Based on RADC-TR-87-50, “R&M Programme Cost Drivers” 
(see Reference 11) a ‘worst case’ estimation of an Availability 
Programme cost in terms of man hours could be derived from the 
following equations: 


Availability Programme Plan = 2.73 x (Number of Tasks)? 


DRACAS Programme Implementation = 8.25 x (Duration 
(months) )2 


Modelling and Allocation Activities = 4.05 x 3 x (Number 
of Items) 


Reliability Prediction ~ 4.54 x (level of detail)? 
x (report formality)? x (% commercial hardware) 


FMEA ~ 17.79 x (Number of Items) 
Availability Programme Management ~ 16% of Total 


These figures are estimates and do not take account of AE exper- 
tise or increased productivity through the use of support tools 
which may be available. If a fairly typical example is taken, based 
on 5 tasks, 6 months DRACAS duration 10 item complexity then 
the predicted cost in man hours is approximately 


(68 + 297 + 122 + 1308 + 178) + 316 = 2289 hour = 65 man weeks 


The accuracy of the constants leads to doubt as to the value of this 
model, as far as LR is concerned. An STD man hour estimate 
would give results less than that given above. The basic cost esti- 
mating process does, however, indicate the value of developing 
and maintaining a parametric cost-model for availability 
programme cost calculation. The current estimate is that an 
Availability programme costs approximately 1% of the capital cost 
of the system, but is clearly system type dependent. 

It is important that the control of the AE programme cost 
assessment exists. The through life cost benefits are also difficult 
to derive because they contain incalculable amounts associated 
with such things as the loss of technical image, the complex notions 
associated with spares holding, spares selling and the basic achieve- 
ment of availability. However it is possible to quantify the 
fundamental cost savings associated with an Availability 
programme through a simulation process similar to those 
discussed above in the relevant Appendices. 


Until cost models and simulation software for assessment of 
cost benefit exist it is impossible to quantify the benefits of invest- 
ment in AE or to determine the optimum investment as shown in 
fig El. The qualitative benefits are, however, obvious. 

The only quantified data that is available to LR is related to 
STD contracts, where cost information is necessarily confiden- 
tial. It is clear from this information however, that the cost of 
AE for major capital investments (Docklands Light Railway, 
North Sea Gas Pipelines, Automotive Industries and 
Worldwide Liquid Natural Gas Transport, Storage and 
Availability of Send-out) is a very effective use of client's 
resources. In fact if one considers the capital investment in 
DLR, LNG transportation and storage, or Offshore pipelines 
then the investment in AE is extremely low. 


Through 
-Life cost 


-Investment 


Cost 


Cost of 
failure 


| ARM & Safety 
Optimum Investment 


Fig. El Relationship between Investment, Availability, 
through Life Costs and Safety 


APPENDIX F 
MANAGEMENT METHODS 


Management of AE programmes depends to a large extent on 
the understanding of the rewards that are associated with the 
integration of the methods that have been described with a 
system development or improvement programme. 

Having the understanding required, it follows that a commit- 
ment to AE is established and communicated to all programme 
personnel. There should be very little need to ‘sell’ the concept, 
particularly when the associated financial rewards, effects on 
company image and improved safety/financial viability are 
summarised. 

Astute management will effectively communicate the 
importance of the linkage and integration in the design process 
of AE and Quality Assurance programmes to produce the asso- 
ciated benefits of: 


Achievement of Specification Conformance 
Customer Satisfaction 

Low Wastage Levels 

Excellence in Design, Development and Production 
Achievement and Visibility of ‘Value for Money’ 
Production of a ‘World Class Product’ 

Production of a ‘Fit for Purpose’ Product 

The benefits of team effort 


The resulting effects of increased business, job satisfaction and 
security, improved industrial technical image, consolidation 
through team effort and success, responsibility for achievement 
of system safety, integrity and availability can be powerful 
incentives for an extension of this approach. 

The complete details of management methods are far 
beyond the scope of this document but hinge on visibility and 
containment of effort. These provide the necessary resources 
for effective man management and play a significant part in 
client liaison, design review, progress reporting and over all 
control of programme achievement. 


APPENDIX G 


GLOSSARY AND DEFINITION OF TERMS 


To begin, the following are Oxford Dictionary definitions of 
terms that are used here: 


Available 
Engineer 


Reliable 
Maintainable 
Safe 

Formality 
Objective 
Comprehensive 
Product 
Process 


Plant 


System 


Capable of being used 

The science or profession of one skilled in 
the construction and maintenance of works 
of public utility 

That may be trusted or depended on with 
confidence 

The ability to carry on, keep up; support; 
assert as true 

Affording security or not involving danger 
Conformity to rules 

Exhibiting actual facts uncoloured by 
exhibitor’s feelings or opinions 

Including much or all; inclusive 

Thing produced by manufacture 

Method of operation in manufacturing 
Fixtures, implements, machinery, etc., used 
in industrial process 

Set of connected things or parts 


The following terms abbreviations and acronyms are 
commonly used in AE programmes. 


Availability 
(Instantaneous) 


Availability 
(Steady State) 


Burn-In 
Corrective 


Maintenance 
Durability 


Environmental 
Stress Screening 


Failure 


Failure Mode 
Failure Rate 


FMEA 
FMECA 


FTA 
Hazard Rate 


Maintainability 


MTBF 
MTTR 


The probability that a system will be 
operating to specification at a particular 
defined time. 

The proportion of time that a system is 
capable of operating to specification within 
a large, defined time interval. 

A Stress test process designed to remove 
weakness due to manufacturing processes, 
materials, ineffective inspection. 

All actions associated with system repair. 


The ability of an item to perform its required 
function under defined conditions of use and 
stated conditions of preventative or correc- 
tive maintenance — until a limiting state is 
reached. 

Similar to Burn-In, however the (ESS)test 
environment is adjusted to simulate a worst 
case system operating environment. 
Termination of the ability of a system to 
perform its specified function. 

The basic cause of failure. 

Frequency of failure, commonly expressed 
in parts per million hours (ppmh). 

Failure Mode and Effects Analysis 

Failure Mode, Effects and Criticality 
Analysis. 

Fault Tree Analysis. 

Instantaneous probability of failure for a 
non-repairable system (ie one failure only). 
The probability that a failed system can be 
restored to fully specified function in a given 
period of time by means of defined correc- 
tive maintenance. 

Mean (or Average) Time Between Failures. 
Mean (or Average) Time To Repair. 


Preventative 
Maintenance 


QMA 


Reliability 
Reliability 
Growth 
Redundancy 
Reliability 


(Intrinsic) 


Software 
Products 
TAAF 


Action taken to maintain a system at 
specified performance — excluding correc- 
live maintenance. 

Quantitative Maintainability Analysis — 
Analytical technique which identifies time, 
tools and skill levels required for all main- 
tenance tasks. 

The probability that an item will perform a 
required function under stated conditions 
for a defined period of time. 

The increase in reliability as a result of 
design modifications resulting from 
extended test and/or use. 

Design providing more than one means of 
achieving a function. 

The basic reliability of a system, dictated by 
design, quality and stress levels — excluding 
manufacturing, installation, maintenance 
induced or wear-out failure mechanisms. 
Computer programs, procedures, rules and 
all associated documentation. 

Test Analyse And Fix. A test procedure for 
removing design weakness. 


@ 


APPENDIX H 
AVAIL CHECKLIST 


Surveyors may like to use the mnemonic ‘AVAIL’ as a mental 
checklist on the possible suitability of AE toaclient’s operation. 
Where AE does appear to have a positive contribution. it is 
worth talking to STD about the feasibility and value of imple- 
menting an AE programme. 
The following list indicates some of the benefits of an 
Availability programme: 
Availability can be pre-determined 
Viability, commercial or functional is assessable 
Assessment of system safety is quantified 


Integrity of system function is validated 


Legislative risk can be minimised 


ios) 


ies) 


APPENDIX I 
RELIABILITY AND MAINTAINABILITY 
QUESTIONNAIRES (EXAMPLES) 


The questionnaires in figs I1 and [2 are industrial examples of 
those that are used in the assessment of the level of involvement 
that is necessary to achieve target Availability. 


Standard Maintainability Requirements (page 1 of...) 
Question Response Comment 


SPEC ASSCSMOSI 
SPEC ASSCSMOSI 
5 

SPEC AV128SO5 119 ParaS.37 


SPEC A5S5CSMO5S1 Para 3.5.3 


Requirement E-15-01/E-15-02 

Requirement E-15:01/E-15-02 
7 SPEC ASSOSMOSI Para 4.2.22 

(and (NRA and SRA oni 


Y 
Are the maintenance procedures compatible with the maintenance concept? 4 With the exception of Combiner R/R at 
‘0' level 
if 
Are anticipated maintenance tasks such that no more than one technician is 
lO 


required at organisational level? SPEC AV-128SCS-113 Para 3.3.7. 


Are anticipated maintenance tasks such that no more than one technician is 
required at intermediate level? 


Are plug-in modules removable without the use of tools? es a ee oe ee 


If tools are required are they are of standard variety? Y (Provided torque wrenches are 
considered standard tools. Check Std) 


Ss 
Is access between plug-in modules and components adequate to allow for 
hand grasping? N/A 


Fig. 1 1 Example Maintainability Checklist 


S 
S 
S 
S 


Has a maintainability task analysis been prepared? YES | 


¥ SPEC AV-128SCS-113 Para 3.3.7.1.2.4 
13 


E 

N 

E 

E 

E 

N 

I 

4 E 


= 


—< are 
ie) —1O 


=e 
oa 


Reliability Design Checklist (page 1 of...) 


Question Response Comment 


Has sufficient detail been included in the Client Specification such that an 
acceptable Reliability Prediction Stress Analysis can be produced? 


| 6 | Does the Reliability Programme Plan address all relevant tasks as defined in BS 5760?} YES/NO aa oe S| 


7 | Has the Reliability Plan been independently checked for completeness and 
consistency with Client requirements? YES/NO 


| 8 | Has the Reliability Programme Plan been Client approved? YES/NO ae) 


ls there sufficient available manpower to implement all tasks as defined in the 
Reliability Programme Plan? YES/NO 


Are there adequate facilities (eg. computer terminals) to accomplish defined tasks YES/NO 
11 | ls there a closed lop Reliability deficiency reporting and corrective action 
system in operation? YES/NO 
12 | Are lines of communication between the Reliability Group and Programme 
Management adequate? YES/NO 
13 | Are lines of communication between the Reliability Group and the following 
disciplines adequate? 
— System Design YES/NO 
— Design Engineering YES/NO 
— Thermal Analysis YES/NO 
— Parts Control YES/NO 
18 | — Quality Assurance YES/NO 


— Logistical Support YES/NO PPE 
~ Software YES/NO 


Fig. | 2 Example Reliability Design Checklist 
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SYNOPSIS 


Investigations on the structural performance of bulk carriers 
revealed that the shipping industry had largely come to accept 
that this ship type would experience structural cracking during 
its normal operation. This investigation also showed that while 
the structural concepts and scantlings of hull components had 
largely gone unchanged over the past three decades, commer- 
cial practices, in terms of loading and unloading, and also 
commercial pressures on the operator had changed for the 
worse. This paper summarises some of the salient parts of the 
investigations carried out by Lloyd’s Register and provides 
guidance on survey practices and some typical defects and 


repairs. 


as 


1. INTRODUCTION 


During the years 1990 and 1991, 25 ships categorised as bulk 
carriers and predominantly carrying iron ore in alternate hold 
loading conditions were lost, in nearly all cases, without trace 
(Ref. 1). These events concentrated the shipping communities 
attention on this ship type. 

In an investigation commenced in 1989, Lloyd’s Register 
identified a number of aspects which were believed to be major 
contributory factors to structural failure and subsequent ship 
losses. Examples of these are as follows:- 


— The average age of the ships which were lost was about 19 
years with the majority being over 20 years. 

— That the ships were predominantly carrying ore and were 
experiencing heavy seas when they foundered. 

— That the evidence available indicates that side shell crack- 
ing and subsequent leakages were consistent events. 

— Where cracking had propagated from localised areas of 
stress concentration this was usually associated with signif- 
icant levels of corrosion. This corrosion could, it was found, 
be very localised in nature such as at the connection of the 
frames to the side shell and hopper plating. 

— That the side shell and transverse bulkhead structures, 
although heavily wasted, could look deceptively good 
when viewed from a distance. 

— That commercial pressures were probably influencing 
structural performance for the worse. 

- That ship operators generally accepted that ships engaged 
in the carriage of dry bulk cargoes, such as iron ore, would 
inevitably experience visible cracking and that this was an 
inherent result of design or operation and therefore was 
acceptable. 


From these observations it was apparent that there was a 
general lack of awareness with regard to this ship type 
particularly in terms of what was happening, or could happen. 
To deal with this, Lloyd’s Register took immediate action and 
implemented more rigorous survey requirements, in terms of 
both extent and frequency. To provide an awareness to the 
shipping community of the consequences of poor maintenance 
and certain operational practices, Lloyd’s Register also 
commenced an ‘awareness programme’ in 1990 and _ this 
included the production and dissemination of technical papers 
and brochures supported by seminars worldwide in an attempt 
to enhance the shipping community’s awareness of the potential 
problems (Refs. 2 & 3). 

It has been said that the most useful and valuable experience 
is that derived from failure and not from success. It was for 
this reason that it was decided to produce this paper so 
that knowledge gained from both the previous and current 
investigations could be consolidated and guidance could be 
made available to surveyors with regard to the likely problems 
to be encountered. 

The safety of bulk carriers has been the subject of intensive 
debate in recent years, and it is true to say that very few ship 
types have been investigated to such an extent in terms of struc- 
tural strength (Refs. 4-8). Recent damages and losses make 
the safety of bulk carriers once again the subject of public 
scrutiny. It has been suggested that inadequate scantlings are 
responsible for many of these failures. Such a viewpoint fails 
to recognise that there are many factors affecting the safe 
operation of these ships, only one of which is the structural 
design standard. 

Bulk carriers depend for their safety on many factors and 
for information purposes some of these are illustrated in Fig. 1. 
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Fig. 1 Aspects which can influence safe life of ships 


2. THE BULK CARRIER AND ITS SALIENT 2.1 Structural Development 
FEATURES 


The following structural development has been seen on recent 


bulk carrier designs: 
rhe term bulk carrier may be applied to all ships which are : 


specifically designed for the carriage of bulk cargoes. The 
bulk carrier had its genesis in the bulk freighters of the Great 
Lakes of North America (Refs. 9 & 10). The trade in iron ore 
and grain led to the development of a single deck ship with 
machinery aft. The various stages in this gradual develop- 
ment are shown in Fig. 2, from which the gradual elimination 
of the internal obstructions can be observed. The complexi- 
ties of the pillaring arrangement of the earlier ships are 
omitted in the diagram for clarity. 


— Use of higher tensile steel for deck structure 

— Increase in size of hatch openings and reductions in width 
of cross-deck strips between hatches. 

— Replacement of web frames in holds with normal frames of 
increased scantlings, see Fig.3 

— Moveawayfromalignment of topside tank and hopper webs 
arrangements. i.e. structural arrangements more oriented 
towards steelwork optimisation 

— Growing use of higher tensile steel for other parts of ship 
e.g. side framing, transverse bulkheads and double bottoms. 


Trunk Decker 1896 


Ayre Ballard 1911 


Shelter Decker 1960 Bulk Carrier-Topside and Bulk Carrier Wing 
6S Hopper Tanks 1960 Tanks 1960 


Fig. 3 Older Framing System (top) 
and Recent Design (bottom) 
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2.2 Typical Structural Configuration 


The most widely recognised structural arrangement identified 
Single Decker 1960 Bulk Carrier with with a bulk carrier is a single deck ship with a double bottom, 
eee hopper tanks, single transversely framed side shell, topside 

Hold 196( pper ta : gle \ , lop 
tanks and deck hatchways (Ref. 11). This configuration dates 
| back to the early nineteen sixties when deadweights of up to 
about 20,000 tons were introduced (Ref. 12). During the 
| period until the early nineteen seventies this design configu- 
ration was extended to ships of about 170,000 tons 
| deadweight. In the mid sixties the utility of the ship type was 
further developed when the O.B.O. (ore, bulk, oil) ship was 
conceived. This development in operational capabilities came 
after considerable investigation which concluded that this ship 


( io Ek 5iI C ce >i ¢ Ae type could carry liquid oil cargoes without destroying the basic 

© r Ore Carrier simple structural concept. Other variants such as Ore or Oil 
carriers and self-unloading carriers, though comparatively 

Fig. 2 The evolution of bulk carrier rare, do also exist. An outline structural arrangement for the 
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cargo area of a typical bulk carrier and nomenclature used is 2.3 Freeboard Considerations 


shown as Fig. 4. 

Bulk carrier design does not alter significantly with size; 
fundamentally the bulk carrier of 30,000 tonnes deadweight has 
the same structural configuration as that of 100,000 tonnes 
deadweight ship and more. This feature enables the consider- 
ation of the performance of this ship type throughout a very 
large deadweight range. Typical dimensions for various dead- 
weight ranges are shown in Table 1. 


Most bulk carriers are designed to take advantage of the reduced 
freeboards permitted by Regulation 27 of the International Load 
Line Convention provided certain subdivision and floatability 
criteria are fulfilled. The result is an increased draught corre- 
sponding to a B-60 reduced freeboard (Ref. 13). One of the 
important implications of the B-60 type ship is that the floatability 
is assessed on the basis of the flooding of any single damaged hold. 
The holds most likely to be controlled in length by flooding calcu- 
lations are the end holds and particularly those at the fore end. 
The advantage of a reduced freeboard can be considerable, 
providing an increase of deadweight in excess of 3,000 tonnes for 
a Panamax size bulk carrier with a relatively small increase in 


Table 1 - Approximate Main Parameters of 
Typical Bulk Carriers 


Dimensions (m) Deadweight Number iweigt 
7 tee 10 
LBPxBxD (tonnes) of Holds Steelweilg nt. 


167 x 29.5 x 14.5 | 36 000 
219 x 32.2 x 18.3 | 69 000 2.4 Cargo Loading Aspects 

256 x 40.5 x 21.2 110 000 Flexibility in terms of operational capabilities is an important 

= - : : P cap I l 

282 x 48.0 x 24.5 186 000 requirement for modern bulk carriers (Refs. 9-12) and in this 


320 x 54.0 x 26.4 254 000 ¢ respect the ships are normally designed to carry a variety of 


6 


cargoes. For cargoes such as coal and heavier types of grain, 
the stowage rate is in the order of 1.15 to 1.3 m3/tonne, corre- 
sponding to the ship loaded down to maximum draught and 
with all holds completely filled, (known as a homogeneous load- 
ing condition). For heavy ore, the stowage rate is about 0.4 
m-/tonne. If the ore cargo is carried in a homogeneous manner, 
each hold will only be about one third full, resulting in a stiff 
ship, ie a low centre of gravity and a large metacentric height 
which is, as a matter of general experience, considered to be 
sea-unkindly. To counteract this, modern bulk carriers are 
designed so that ore cargoes can be carried in alternate holds 
and some cargo spaces remain in this respect empty. This 
arrangement also has a further advantage to the ship operators 
in that only the ore holds need to be worked during loading and 
unloading operations. This of course reduces the time spent in 
port. 

It is common for larger bulk carriers when carrying ore to 
load only the odd numbered cargo holds and hence making it 
easier to achieve a satisfactory trim. However the alternate hold 
loading pattern greatly increases the strain in the double 
bottom structure due to the downward loading in the ore holds 
in association with the full buoyancy upthrust in the empty 
holds. Further the shear forces in the side shell are also likely 
to be increased considerably because of this loading arrange- 
ment. 


2.5 Ballast Arrangements 


In addition to the water ballast capability provided by the fore 
and aft peaks, a major part of the double bottom and the hopper 
and topside tanks of a bulk carrier is also arranged for the 
carriage of water ballast. The use of topside tanks for water 
ballast increases the rolling period, and makes for a more 
comfortable ship (Refs. 10 & 14). This arrangement also has 
the structural advantage in that the location of structural 
concentration is in the corners of the midship section, and thus 
effective in resisting hydrodynamic torque. In larger bulk carri- 
ers the double bottom and hopper tanks are often 
interconnected with the topside tanks by vertical trunks or 
pipes arranged at the ship’s sides, at each end of the tanks. In 
such cases the boundaries of the double bottom and hopper 
tanks must be suitably strengthened for the increased pressure 
head. 

It is also common practice to adapt one or two cargo holds 
amidship for the carriage of water ballast by making the 
boundaries equivalent to deep tank standard. This ballast 
arrangement is in addition to all the other aforementioned 
water ballast capacity and is provided to achieve a satisfactory 
deep draught forward to minimise slamming damage and 
reduce propeller emergence in adverse weather conditions. 

This arrangement may also have the additional merit of 
reducing the still water longitudinal bending stresses on the 
ship. It is usually expected that ballast holds will be 100% filled 
in seagoing conditions, where this is not so, the effects of slosh- 
ing will require to be considered. 

During loading and unloading operations, it is often neces- 
sary to partially flood one or two other holds in harbour or 
estuaries to counteract the air draught problem created by 
bridges or where the limited height of the loading chutes means 
that the ship must not be too high above the water level. 


2.6 Class Notations 


The structure of a bulk carrier must be appropriate to the most 
onerous trade in which it is likely to engage. Lloyd’s Register 
recognises three main classes of conventional bulk carrier viz 
(Ref. 15): 


CLASS +100A1 
CLASS +100A1 


BULK CARRIER 

BULK CARRIER STRENGTHENED 
FOR HEAVY CARGOES 

BULK CARRIER STRENGTHENED 
FOR HEAVY CARGOES, HOLDS 
NOS. (SPECIFIED) MAY BE EMPTY 


CLASS +100A1 


These notations refer to the structural scantlings and arrange- 
ment adopted in conjunction with the intended cargo. The 
difference between the first two are that for obvious reasons 
the double bottom of the ship having the notation 
“Strengthened for Heavy Cargoes” has scantlings and arrange- 
ments suitable for the heavier cargoes, as required by the Rules. 
The last class notation is assigned to bulk carriers additionally 
designed for the carriage of heavy ore cargoes in alternate holds 
when the ship is loaded to maximum draught. In this case the 
double bottom structure is strengthened to comply with the 
Rules based on the calculated nominal stowage rate for each 
particular hold. 


3. REVIEW OF DAMAGES AND 
STRUCTURAL DEFECTS 


Ship structural configuration and service dictate, to a large 
extent, the location and extent of damages. Other important 
parameters are the materials used, the design of details and 
the quality of workmanship during construction. Operational 
practices and the commercial environment in which bulk 
carriers operate can also exacerbate the situation. 


3.1 Hull Damages 


Locations where cracks may generally occur have been found 
to be as follows: 


— in deck plating at hatchway corners 

— at hatch coamings and associated extension brackets 

— at the connections of sloping topside tank platings to 
transverse bulkheads, ie at the fore and aft extremities 
of cargo hold area 

— at toes of both upper and lower side frame brackets 

— at the intersection between the inner bottom and the 
sloping hopper plating 

— at the connection of vertically corrugated bulkheads to 
lower stool and to sloping topside tank plating 

—  atconnections of access trunks to sloping hopper plating 

— at boundaries of lower stool and inner bottom plating 

-— side shell plating 

— In the double bottom structure, particularly in way of 
cut-outs in floors for the passage of longitudinals 

~ Locations of transitions in cargo spaces fore and aft, at 
collision and engine room bulkhead location. 


To assess more specifically where failures have occurred over 
the ships length an examination was made of information 
from LR’s database of hull damages. Parameters used in the 


Table 2 - Hull Damages (counts (%) by structure and hull section) 


Bulk Carriers: 20 000 to 64 999 DWT 


Structure 


Upper Deck 


interrogation of the data base were: 


— Bulk, Ore/Oil and OBO Carriers built to +100A1 class and 
the date of build from January 1970. 

— Two ranges of deadweight were chosen, viz 20,000 to 
64,999 DWT and over 65,000 DWT. 

— Cause of defect was specified as non-contact and type of 
defect was specified as fractured, cracked, brittle fracture 
or lamellar tear. 


Findings of this assessment are given in Table 2. From these 
statistics it appears that ships in the larger deadweight range 
experience higher levels of fracture in their deck structure over 
the mid length region than their smaller counterparts. This, it 
is considered, is due to the higher magnitude of stress from the 
hull girder bending and the stresses inflicted by inadvertent 
overloading. On ships within the smaller deadweight range 
chosen it is also apparent that a greater percentage of fractures 
occur in the forward side shell area and this is probably due to 
the operational requirements for ships of this deadweight 
range, eg operation in more constricted waterways. 


3.2 Side Shell and Associated Frames and End Brackets 


The watertightness of the hull depends critically on the struc- 
tural integrity of the side shell structure and it is naturally 


considered to be the first line of defence against the ingress of 


water. It is concerning, therefore that casualty investigations 
conducted by Lloyd’s Register have clearly shown that failure 
of the side structure have dominated the damage statistics. 
Typical damages found in this area are the wastage and 
grooving of the frames and associated end brackets. This 
normally results in cracking of frame brackets, frame webs and 
subsequently in the buckling or detachment of the frames from 
the shell plating. Mechanical damages in the form of indenta- 
tion of the frame bracket face plates and occasionally to the 


SUB-TOTAL 


Ea EA TT “700:00 


Structure 


SUB-TOTAL 


Upper Deck 


45.94 


Sides 


30.64 


Bottom 


23.42 


FWD-MID 


indentation of the frame bracket face plates and occasionally 
to the frames themselves have also been reported. 

The cracking of frame bracket toes depends on the type of 
configuration. Where separate brackets are employed the 
cracking location is more likely to be at the bracket toe position 
on the frames whereas with integral brackets the crack location 
is at the toe location on the hopper and topside tank, see Fig. 5. 
With the integral bracket design, the cracking has been found 
to be almost self-limiting with a very small propagation rate 
after the initial occurrence. In the case where separate brackets 
are fitted experience has shown that cracking, once it has 
occurred, propagates very rapidly to the side shell. 


Topside 
Topside tank tank 
Side 
shell 
Fractures 
Side frame 
Crack 


Hopper 


Separate bracket 


Integral bracket 


Fig. 5 Examples of cracking of side framing 


3.3 Transverse Bulkheads and Associated Structures 


Bulkhead structure is not only a primary strength element in 
the design of ship structures, but also acts as a second line of 
defence against progressive flooding. The structural effective- 
ness of transverse bulkheads is therefore of crucial importance. 

One major type of failure frequently reported is the collapse 
of corrugated transverse watertight bulkheads during ballast- 
ing and deballasting operations in cargo holds designed to 
contain water ballast. The main cause of these damages is 
considered to be the inadequacy of venting or piping arrange- 
ments or poor operational practice. 

Excessive corrosion and wastage of bulkhead structures, 
particularly at mid-height and bottom, is also a problem and 
this can result in buckling of component structures leading to 
collapse under water pressure in an emergency condition. The 
structure may sometimes appear to be in good condition but it 
is in fact heavily corroded. Close up inspection and the verifi- 
cation of thicknesses using ultrasonic thickness gauges is 
therefore important. 

There have been several cases of fracture in the connection 
between the plating of the deep tank corrugated bulkheads and 
the lower stool shelf plate, and in the adjacent underside 
connection between the bottom stool side plating and the shelf 
plate. Fractures have also been experienced at the connection 
of the bottom stool plating and the inner bottom, but to a lesser 
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extent. Fractures have been reported at the ballast trunks 
between the topside and hopper tanks in way of weld 
connections to topside and hopper tanks. There are also cases 
where lamellar tearing has occurred in the platings 
forming the lower stool shelf plates and inner bottom plating 
at base of bulkhead. 


3.4 Hatch Covers, Coamings and Their Supporting 
Structures 


One of the possible routes for sea water to get into the holds is 
through the hatchway of bulk carriers. In this respect the struc- 
tural performance of the hatch cover and its supporting 
structures is of great importance (Ref. 13). 


3.4.1 Hatch Cover Damage Statistics 


A sample of 164 bulk carriers which reported some form of 
damages/defects to hatch covers was extracted from LR’s 
database of hull damages. The defects are classed under the 
heading of plates buckled, plates fractured, stiffener buckled, 
stiffener fractured, total loss and other defects which includes 
damages to packing, jointing and other non-structural compo- 
nents. It has been found that most of the failures are related to 
non-structural components. Failures due to plate buckling and 
fracture amounted to about 31%, while about 9% of the total 
is attributed to stiffener buckling and fracture. 

The longitudinal distribution of damages is given in Table 3. 
It can be seen that more than one third of the damages were 
found at the forward-mid region. 

Other significant damages reported are the overloading of 
hatch covers by way of over pressure or under pressure within 
the ballast holds by employing high capacity pumps in associ- 
ation with inadequate venting and piping arrangements. 

While it is true that the penetration of asmall amount of water 
past the gasket is insufficient to endanger the safety of the ship, 
the loss of a hatch cover can be detrimental, especially under 
heavy weather conditions. The loss can be caused by failure of 
the securing mechanisms which are considered to be non-struc- 
tural, or structural failure. Another important aspect which 
merits attention is that the repairers of hatch covers should be 
made aware of the critical importance of using the correct size 
and materials for the renewal of damaged/defective components. 


3.4.2 Hatch Cover Supporting Structures 


Incidents of cracking or fracturing in the deck plating at hatch 
corners, hatchway coamings and at the side coaming extension 
brackets have also been frequently reported. These supporting 
structures are usually situated at locations which are highly 
stressed due to the combined effect of hull girder bending, trans- 
verse loading, hydrodynamic torque, structural discontinuity 
and corrosion. In the case of the hatch coamings, mechanical 
damages sustained by grabs are a common occurrence. 

Fractures which featured prominently in damage records 
include those occurring at the top of the coaming and/or coam- 
ing top bar, or at the mid-depth of the hatch coamings in way 
of cut-outs and notches for the hatch cover operating arrange- 
ment, in the fillet weld connection to the deck of radiused 
coaming plates, at the corner junction of the longitudinal and 
transverse hatchway coamings and at the termination of the 
side coaming fore and aft extension brackets. Fractures at 
hatchway corners emanating from welded attachments close to 
or on the free edge of the hatch corner plating and grooves 
caused by grab cables have also been reported. 

Many of the problems mentioned can be cured to some 
extent by better detail design and a better estimation of loads 
emanating from different sources. 


Table 3 - Defect types as a function of longitudinal region 


Hatch Covers Damage Statistics —- Defect Types and Counts (%) 


Stiffener 
Buckled 


Plates 
Fractured 


0.0 

0.86 
1.43 
1.15 


Structure 


3.5 Topside and Hopper Tanks Structures 


Corrosion related structural damages of the internal structures 
of the topside and hopper tanks is a major problem, particularly 
for older bulk carriers. There have been cases where this gave 
rise to localised buckling, e.g. at transverse webs, or fracturing 
at connections. Good detail design and the correct application 
of coatings to manufacturer’s specifications on these structures 
can alleviate these corrosion related problems. 


3.6 Fore and Aft End Structures 


Evidence available indicates that most of the failures reported 
have been associated with heavy weather and occurring in the 
fore deck area, with other focal locations being in the bow and 
side shell plating. Severe damages can also occur in the bottom 
forward if the vessel operates ina light ballast condition without 
adequate reinforcement in this region (Ref. 16). 

Vibration is usually quoted in damage reports as the cause 
of most of the fractures occurring in the aft end structural 
components (Ref. 16). 

Inadequate scarphing at the fore and after ends of the 
topside tank sloping platings can also create localised cracking. 
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3.7 Double Bottom Structures 


Double bottom structures are susceptible to damages during 
loading and unloading operations. Locations such as the inter- 
section between the inner bottom plating and the sloping 
hopper plating are focal points for stress concentrations and 
fatigue cracking. Double bottom structures, under floodable 
holds or deep tanks, are also susceptible to cracking particularly 
at the intersection of longitudinal girders with floors under 
transverse bulkhead structures. Connections of flat bar floor 
stiffeners to both inner and outer bottom longitudinals can 
experience fatigue fractures due to local areas of stress concen- 
tration and in many cases this can be exacerbated by vibrational 
forces. 


| 


4. INFLUENCE OF CARGOES AND THEIR 
HANDLING ON SAFETY 


4.1 General 


The nature of cargoes carried during a bulk carrier’s service life 
has an important bearing on its safety. The unloading of cargoes 
by grabs and other mechanical equipment can cause problems 
on these ships (Refs. 17 & 18). 


4.2 Loading of Ships 


4.2.1 Bulk Cargo Specifications 


The bulk cargo specification contained in most hauling 
contracts issometimes vague and limited. Important data which 
may influence the shifting of cargoes, such as the angle of repose 
or moisture content may be omitted. It is important that the 
specifications should contain more meaningful data on physical 
characteristics and chemical compositions so that more intelli- 
gent design evaluation of loading and unloading methods can 
be made. 


4.2.2 Loading Rates 


When the majority of bulk carriers were built, loading rates 
were in the region of 3,000 tons per hour (TPH). Today loading 
rates of well over 10,000 TPH are not uncommon. Some iron 
ore terminals are designed to load at 16,000 TPH, and some 
attempt to boost their loading rates with two units at 32,000 
TPH. At these rates ships can be visually observed moving 
downward and these intermediate loading conditions are more 
severe than those considered when planning the loading oper- 
ation. New designs should take the high loading rate into 
account and older vessels should be rechecked to ensure that 
no excessive stresses are introduced. Table 4 shows the sensi- 
tivity of hull girder bending moments and shear forces to cargo 
distribution in different holds. 


4.2.3 Loading Impact 


Free falling material from the shiploaders create significant 
forces. For example, while loading at 6,000 TPH and with 17.4 
metres free falling height, impact forces of about 3 tons are 
generated. In contrast, when loading at 16,000 TPH and drop- 
ping 18.3 metres, the generated forces are close to 9 tons. It is 
important that these significantly increased and locally gener- 
ated cumulative impact forces should be considered in the 
design of modern bulk carriers and this is currently being 
considered for future Rule reviews. 


4.2.4 Trimming of Cargoes 


It is recommended that the cargo in the holds be trimmed in an 
attempt to minimise the risk of cargo shift (Ref. 18). 


4.2.5 The Avoidance of Over-loading 


It is found that great variation in structural performance occurs 
even for a group of very similar ships carrying similar cargoes. It 
would appear that the operators of those ships which incur mini- 
mum damage are particularly cautious with regard to loading ore 
cargoes and employ a large number of loading passes in an 
attempt to reduce the likelihood of overloading individual holds. 

Most cargo handling contracts specify that draft marks 
should be used to determine the cargo deadweight. Modern 
belt scales can achieve, with proper maintenance, better accu- 
racy than draft mark readings. Belt scales are also helpful in 
controlling and co-ordinating the cargo flow into individual 
holds. With proper planning correct trimming can be completed 
in time without costly additional shifting of cargo. 


4.3 The Problems of Unloading by Grabs 


In response to the commercial pressure, unloading ports have 
developed more efficient facilities for unloading cargoes. This 
has resulted in an increased grab size, ie in terms of both capac- 
ity and unloaded weight. Indeed it is not uncommon for 
unloaded grabs to weigh as much as 35 tons. 

It is probably true that the damages caused by grab buckets 
represent the most significant repair cost of bulk carriers. 
Damages to tank top and coamings are the most common, 
however, damages to main frame lower brackets and transverse 
bulkheads have also been reported. 

The basic operating problems for grabs are the result of the 
high lifting and shuttle speeds required to produce an accept- 
able output. Average hoisting speed is in the range of 1.5 metres 
per second, but can go up to 4.1 metres per second. When a 
grab bucket is lowered at 1.5 metres per second into the hold 
the generated impact forces are about 7 tons. This force can 
increase many times when hitting steel plates beneath the cargo. 
Large grabs with 85 tons lifting capacities may produce under 
similar operating conditions an impact force of about 14 tons. 
While unloading a 200,000 DWT bulk carriers 8,000 to 12,000 
grab movements are executed. Each movement represent a 
large number of individual control steps, which have to be 
performed properly within a time frame of about 60 seconds. 
It is obvious that the scope for human error is huge. Computer 
control may greatly improve the accuracy of unloading, and 
with proper design, damages can be minimised but not 
completely eliminated. 


Table 4 - Sensitivity of hull girder to cargo distribution of a 70,000 DWT bulk carrier with 7 holds 


Cargo in Cargo in Cargo in 
N° 1 Hold N° 3 Hold N° 5 Hold 
(t) () (t) 


15,304 


Loaaing Condition 


Ore Loaded Condition 
(as in loading manual) 
5% cargo of N° 5 
loaded into N° 1 


10% cargo of N° 5 
loaded into N° 1 


16,211 


agin 


Cargo in Maximum Maximum 

N° 7 Hold SWBM SWSF 

() (t=m) () 
144,691 
(99.1%) 
174,005 

(119.2%) 
203,114 

(139.1%) 


Ship 
Draughts 


4,906 
(97.5%) 


5% cargo of N°5 
evenly loaded into 
N° 1 and N° 7 


169,075 
(115.8%) 


10% cargo of N° 5 
evenly loaded into 
N° 1 and N° 7 


193,559 
(132.6%) 


¢ Bulkhead factors applied to shear forces ¢ Figures in parenthesis indicate % of Rule allowable values for seagoing condition 
¢ Total cargo weight unchanged in all cases 


Other types of equipment employed to free cargoes includes 
hydraulic hammers fitted to the extending arms of tractors, and 
the use of bulldozers to clear cargoes can inflict further damages 
to the ship structure, especially the side shell, its associated 
frames and end brackets. 


4.4 Hazards of Cargoes 


The international standard for the safe stowage and marine 
transportation of bulk cargoes including ores, ore concentrates 
and similar materials is set out in the IMO Code of Safe Practice 
for Bulk Cargoes (Ref. 19). 

One of the most important mechanisms which reduces the 
ship’s overall structural integrity is metal wastage due to corro- 


sion. The corrosion process depends on a number of 


contributing factors which include the temperature, moisture 
and sulphur content of the cargoes in the holds. Differential 
temperature together with high moisture content can create 
significant sweating at the interface of side shell and topside 
tanks and any other interface which is at different temperatures. 
The situation is aggravated by the presence of sulphur in some 
cargoes which produces at the condensation interface a corro- 
sive liquid which attacks the steel. An example of a heavily 
corroded side shell structures is shown in Fig. 6. 

One way of delaying the onset of the problem, apart from 
regular inspection and maintenance, is to provide an epoxy 
based coating, particularly for areas such as web plates and the 
inner side of the flange plate of the frames. 


Fig. 6 An example of heavily corroded side frame structures 


§. IMPLICATIONS OF DESIGN DETAIL ON 
SAFETY 


Shipbuilding is a commercial enterprise where the objectives 
are the optimisation of expenditure on an end product where 
basic fitness for purpose is the design objective. In the case of 
bulk carriers the gradual optimisation of materials and the 
reduction of structural reserve, as previously described, has 
made the importance of detail design even more important. It 
is apparent that the close attention to detail design can have 
rewards in improving structural performance and also the life 
of protective coatings. The costs in attaining this are, however, 
a major deterrent. (Ref. 20) 

It is not the intention of this paper to discuss in depth ship 
design detail which is a vast and complicated subject. Some 
guidance and suggestions in this area will be offered later in 
this paper, in the section on surveying and repair. Rather it is 
intended to re-emphasise the importance of design detail in 
modern ship structural design as a result of the advance in mate- 
rial technology and the environment which prevails in the 
shipping industry. 


5.1 The Effects of Computer and Material Technology on 
Design 


Modern ships in general, and bulk carriers in particular, are 
lighter than they used to be. This reduction in steel weight has 
been achieved due to the combined effects of the introduction 
of higher tensile steel (HTS), contemporary Rule changes, 
structural optimisation and structural analysis techniques. 


5.1.1 Structural Optimisation 


While on many ships such as oil tankers the process of structural 
optimisation has been largely due to the use of new technology 
and resources in the form of computer analyses capabilities, the 
optimisation of bulk carriers is mainly associated with the 
introduction of new cost effective materials, i.e. higher tensile 
steels, and the requirements of operation. Aspects mentioned 
previously, such as the deletion of web frames of increased 
scantlings, have reduced structural reserves and therefore 
necessitate the need for good detail design and constructional 
controls during the building of the vessel. In addition the reduc- 
tion in structural redundancy also makes the ships’ structures 
more sensitive to maloperation and to poor maintenance. 


5.1.2 The Use of Higher Tensile Steel 


With only a marginal price differential, current price ratio per 
unit weight being only 1:1.08, between mild strength steel to 
higher tensile steel (HTS) having a yield strength up to 
36 kg/mm? and no appreciable increase in fabrication costs, 
there is a large scope for cost savings for both the ship builder 
and owners (Refs. 21 & 22). However there are also many disad- 
vantages associated with the use of HTS. Some of those 
considered relevant to this paper are discussed here. 

Construction with HTS requires higher fabrication stan- 
dards than mild steel and is less forgiving of poor workmanship 
and is particularly sensitive to design details. Corrosion rate is 
generally independent of original plate thickness and HTS 
scantlings, being thinner than mild steel constructions, will use 
up the corrosion margin earlier (Ref. 22). Another point to note 
is that HTS has no advantage over normal strength steel in so 
far as buckling strength is concerned when increased stress 
magnitudes are imposed. 

In a general sense, fatigue ageing and failure is associated 
with design details of ship structures at high stress locations 
such as discontinuities, weld toe etc. Fatigue is the term used 


to describe the ageing of structures subject to cyclic stress. This 
process leads to the initiation or propagation of cracks in struc- 
tures. Some basic configurations of structural members and 
possible crack locations are shown in Fig. 7 (Ref. 23). 


Description Basic element 

1 Base plate’ 
butt weld 
joint 


2 Lap joints 
taper plate 
joint 


3. T-joint 
fillet weld 
joint 


Crack 


4 Stiffener 
end 
bracket 


end 


5 Face bar 
end 


Fig. 7 Basic elements of hull structure 


The use of HTS permits lighter scantlings and results ina more 
flexible structure and higher magnitudes of stress. The problem 
is compounded by the fact that HTS has little fatigue strength 
advantage over mild steels, and thus it will endure a shorter 
fatigue life when exposed to stress cycling at the higher permitted 
stress levels unless appropriate measures are taken (Ref. 24). 

An approach to this problem is to control more carefully the 
detail design in the case of the use of HTS and this may entail the 
use of direct calculation procedures. A procedure which involves 
the classification of the joint geometry and properties with match- 
ing S-N curves and the synthesis of long term load response 
spectrum taking into account the ship’s service history has been 
developed by Lloyd’s Register to determine fatigue life (Ref. 25). 

For bulk carriers the areas shown by experience to be at risk 
are the main frame brackets, topside tank structure, hatch 
corners, hatch side coaming ends, lower hopper corners and 
hold transverse bulkheads. Means to improve fatigue perfor- 
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Fig. 8 Stress concentration study of the hopper knuckle 


Shelf plate 


Fig. 9 Location of strain gauges 


mance in these areas in terms of detail design involve the soft- 
ening of extremities by provision of radii, by the provision of 
increased local thickness to reduce dynamic stress ranges and 
by improving the welding details and paying special attention 
to welding sequences. 


5.2 Case Studies on Effect of Design Detail on Stress Levels 


5.2.1 A Comparative Study of Knuckle Connections 


The intersection of the inner bottom and hopper platings has 
been a focal point for structural problems on this ship type for 
decades. Comparative studies have been carried out on these 
locations by, amongst others, Japanese shipbuilders during 1972 
who confirmed that structural scarphing and the minimisation 
of stress concentrations at these locations are important if crack- 
ing is to be avoided (Ref. 26). Evidence would indicate that where 
cracking has been found in these locations it is very difficult to 
overcome the problems and affect a permanent cure. 

Many investigations have been carried out on this area by 
Lloyd's Register as this detail is common to other ship types, such 
as gas carriers and even new generation double hull VLCC’. 

Results of the most recent studies employing finite element 
methods and supported by experimental testing again confirms 
the need for careful design at these locations. An example of 
stress concentration factors obtained from an earlier study by 
LR is shown in Fig. 8 

Success of detail arrangements in these areas is also largely 
dependent on the provisions made for welding and the absence 
of ‘in built’ cracks due to lack of weld preparation/penetration 


§,.2.2 Strain Measurement of Bulkhead and Stool Connection 


Structural problems have been reported at the ballast hold trans- 
verse bulkhead lower stool shelf plate to sloping stool face 
connection. It was decided to strain gauge this area on a ship to 
investigate the origin of the problem. The strain gauge measure- 
ment system installed in the area of interest is shown in Fig. 9. 
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The problem was traced back to the rat holes in the stool 
diaphragms which gave rise to the high stresses encountered. 
It was decided to fill in all relevant ratholes. Fig. 10 shows the 
strain measurement results during static tests before and after 
the ratholes were filled. The dramatic decrease in strain 
measured is evident. 
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Fig. 10 Measured Strains 
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6. GLOBAL STRENGTH CONSIDERATIONS 
6.1 Longitudinal Bending and Shear Strength 


The longitudinal bending and shear strength of bulk carriers is 
examined in the usual way, taking the implication of the class 
notation into consideration. Indications are that there is 
no major problem reported as coming from the homogeneous 
loading conditions. For ships with the “Strengthened for Heavy 
Cargoes in Alternate Holds” notation, additional strengthen- 
ing is generally required and particular attention must also be 
paid to operational procedures during loading and unloading 
as described earlier. 


6.2 Torsional Strength 


Bulk carriers have large openings in the deck, torsional strength 
and rigidity are provided by the double bottom, hopper and 
topside tanks. Hydrostatic torsion arises by virtue of asymmet- 
rical loading port and starboard (Ref. 18). In a sea-way, 
especially in the case of an oblique sea condition, torsional 
moments are set up by virtue of asymmetric distribution, port 
and starboard, of hydrostatic and hydrodynamic forces, includ- 
ing slams, and by the motion induced inertia forces of the ship. 
All forces the ship experiences which do not pass through the 
shear centre axis of the hull girder give rise to torsion. 

When a ship is subjected to torsion, warping of the cross- 
section occurs. This gives rise to a shear force and bending 
moment at the cross-deck strip ends as shown in Fig. 11. The 
bending stress varies both across the width and along the length 
of the cross-deck strip from a maximum at the edges to zero at 
centre. A recent damage case on a bulk carrier which suffered 
extensive cross-deck buckling between hatch openings has 
demonstrated that it is necessary to assess the strength of the 


cross-deck strips when subjected to the combined action of 


hydrodynamic torque, local out of balance cargo weight and 
external sea pressures which are supported by the reactions set 
up in the bulkhead structure (Ref. 27). These forces work 
together at the hatch corners and research today indicates that 
this is one of the factors which gives rise to the recurring 
damages at these locations. Remedial actions to circumvent the 
problem will be discussed later in the surveying section. 


6.3 Transverse Strength 


A bulk carrier of single side configuration obtains its transverse 
strength from the double bottom and from transverse bulk- 
heads structures which take the end loads from the hopper and 
topside tanks. With the deletion of web frames from the hold 
spaces and the absence of the need for alignment between the 
double bottom floors and the topside tank webs the end effects 
on the frames are not consistent due to the variances in structure 
supporting the upper and lower end brackets. In cases of major 
damage the variations in fixity of frames can be often reflected 
in variations in failure pattern. In view of the role played by 
side framing structures in providing the first line of defence 
against flooding considerable effort has been placed on moni- 
toring the behaviour of these members under operational 
conditions. In this respect these programmes of measurement 
were instigated to provide an insight into both the behaviour 
of frames made from normal yield and higher yield materials. 
This work is still ongoing but service performance to date has 
been reflected in Rule amendments to improve the robustness 
of these members. 
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Fig. 11 Torsionally induced deck strip loads 


7. STRESS ANALYSIS 
7.1 Analysis of Side Frame 


A detailed three dimensional finite element analysis for the 
side structure of a ship which has suffered serious damages 
has been carried out (Ref. 26). The model consists of two 
built up frames attached to the side shell as well as the 
topside and hopper tanks as shown in Fig. 12. Deformed plots 
illustrating the effect of the rotation of the tanks on the side 
frame due to laden and empty hold conditions are shown. 

In the ore condition, significant tensile bending stresses 
are found in the lower portion of the side frames and brack- 
ets, which fluctuate with passing waves. Higher stresses 
would obviously occur if the side frame and brackets are in 
a corroded state. This fluctuating load mechanism makes the 
bracket toes prone to fatigue failure. 


7.2 Analysis of Corrugated Bulkhead 


Structural problems can occur in the ballast hold transverse 
bulkhead bottom stool shelf plate/sloping stool face connec- 
tion (Ref. 29). The ballast hold bulkhead transverse stool 
area of a capesize bulk carrier (nine holds) was strain gauged 
and a finite element analysis carried out to investigate this 
problem. 

The analysis has been performed for a number of load 
cases and the results compared with a series of strain gauge 


measurements carried out on the ship during a number of 


loading and ballasting cycles during operation. 


7.2.1 Structural Idealisation 


A very large three dimensional finite element model represent- 
ing the port side of the ship has compiled. The area of interest 


Buoyancy 
moment 


Empty condition 


was the connection of the ballast tank bulkhead to the lower 
stool between holds 5 and 6. The model extends longitudinally 
throughout holds 5, 6 and 7 and vertically over the entire depth 
of the ship. 

A deformed mesh plot of the model which has about 80,000 
degrees of freedom is shown overleaf in Fig. 13 together with 
a diagram showing the fine mesh employed in the region of the 
strain gauges. 


7.2.2 Loading Conditions 


Five loading conditions have been examined and were supplied 
by the ship. The first four represent the stages of unloading and 
ballasting the ship at port. The fifth loading condition repre- 
sents an alternative operating condition employed by the 
operators to reduce the shear forces in the hull when in ballast. 
These five conditions are as follows: 


(1) Loaded with iron ore on arrival (LC1). 
(2) Prior to filling the number 6 ballast hold (LC2). 
Cargo partial discharged, number 3 double bottom includ- 


ing the lower stools and the topside tank full. 


(3) Number 6 hold full with ballast water with cargo further 
discharged (LC3). 


(4) Departure in ballast (LC4). 
(5) Special ballast condition (LCS). 
Several additional load cases have also been considered as 


means of checking the loading data and used to determine the 
effect of cargo distribution. 


Ore condition 


Ore moment 


Fig. 12 Deformed plot of the side frame study 


Measured value = 297 N/mm 


Fig. 13 The finite element mesh (deformed) showing area of interest 


7.2.3 Results and Comparisons with Strain Gauges 
Measurements 


7.2.3.1 Displacement Results 


Fig. 13 shows the deformed plot of the entire model for loading 
condition LC3. In this loading condition, number 6 hold is 
filled with ballast water to the top of the coaming. The resul- 
tant pressure on the double bottom overcomes the upwards 
buoyancy load and produces a net downwards deflection of 
the double bottom relative to the bulkhead stools. The water 
pressure pushes the two bulkheads apart resulting in signifi- 
cant bulkhead deflections; bulkhead 5/6 deflects forwards by 
20mm relative to the shelf plates at the centreline. Significant 
deflections arise at the upper stools and associated deck struc- 
ture. 

Fig. 14 compares the relative deflections of the bulkheads 
between Nos 5 and 6 holds in five loading conditions. 


7.2.3.2 Stress Results and Comparisons with Measurements 


Fig. 15 shows the distribution of stress in the forward bulkhead, 
in loading condition LC3. The average vertical stresses indicate 
the flow of the vertical load through the bulkhead, stool and shed- 
der plates. As expected, the aft flange of the bulkhead is in 
compression at mid-depth and in tension towards the lower stool, 
i.e. the bulkhead corrugations behave as partially clamped 
beams. The torsional stiffness of the upper stool and associated 
deck structure is smaller, so the upper part of the bulkhead aft 
flange hardly goes into tension, except in way of the topside tank 
which provides greater support. Fig. 16 shows the vertical stresses 
in the bulkhead and stool in the same loading condition. The 
stress concentration at the connection is highlighted. The black 
element immediately below the corner of the bulkhead corruga 
tion indicates a stress slightly in excess of 275 N/mm2. The gauged 
value at this location was found be 297 N/mm2. The remedial 
action to relieve the stress concentration was, as previously 


discussed, to fill all relevant ratholes in the stool diaphragms ) 
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Fig. 14 Deformation of forward bulkhead in five loading conditions 


Fig. 15 Contours of vertical stress in forward bulkhead for 
loading condition 3 
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Fig. 16 Distribution of element surface vertical stress for 


loading condition 3 


8. TOTAL LOSS SCENARIOS 


In the worst bulk carrier tragedies, those where the ship disap- 
peared or sank, it appears that in many cases there were no 
reports of initial failures. The total loss of a ship under such 
circumstances always raises disturbing and sometimes unan- 
swerable questions. Evidence available indicates that water 
ingress into the ship holds is a recurring scenario. The survival 
of a ship depends on its ability to keep water out. The sequence 
of events which could lead to the rapid loss of a bulk carrier 
may be visualised as follows: 


(i) Flooding of a forward hold leading to the collapse of a 
highly corroded transverse bulkhead (see fig. 17) and 
thereafter the progressive flooding of the holds which 
leads to rapid loss of buoyancy; and 

(ii) Flooding of a hold loaded with ore which leads to the 
collapse of a highly corroded double bottom structure. 
This localised failure could reduce the effectiveness of the 
double bottom against hull girder bending which in turn 
could lead to the overall failure the hull girder. It is also 
possible for the strength of the transverse bulkheads to be 
severely affected by double bottom failure leading to the 
alternative possbility of progressive hold flooding. 


Fig. 17 An example of bulkhead collapse 


Another obvious point to be addressed is, how does the water 
enter the hold space in the first place? From the evidence avail- 
able in the proceeding paragraphs, it would appear that frame 
bracket cracking leading to side shell cracking or even side shell 
loss (see fig. 18), is perhaps the most likely scenario. The crack- 
ing in the side shell need not, however, be necessarily a dramatic 
initial event as this may even be initiated from an area of stress 
concentration on the side shell, such as the end of a flat bar stiff- 
ener which may have been badly corroded or inadvertently 
added during repairs. In the latter case the flooding would be 
very much slower until the next phase of the damage occured 
and progressive flooding or hull girder failure takes place. 
One of the major problems is that flooding of a hold space, 
for example from damage to the hatch covers (see fig. 19), may 
occur without the knowledge of the crew, particularly in 
typhoon conditions where visibility may be minimal and any 
changes in the response of the ship may be masked by the storm 
he influence of flooding number | hold ona bulk carrier carry- 
ing ore, from a naval architecture point view, is of course to 
create a significant trim by the head and it is considered that 
on a Well maintained ship this should be a survivable situation 
In the event that flooding progresses to the adjacent number 2 
hold then the consequent trim can immerse the deck forward 


and the survivability of the ship under storm conditions 
becomes doubtful. How the flooding progresses from one to 
hold to another is also important and if this is a consequence 
of tranverse bulkhead failure then the shock loadings, both in 
terms of over and under pressures could create a chain reaction 
involving hatch covers being displaced, bulkheads collapsing 
etc within a few seconds resulting in an almost instantaneous 
loss of hull buoyancy and the ship sinking. 

Knowing when the holds are taking in water is, therefore, 
considered very important. While more typical water detection 
systems such as float alarms could become damaged during the 
occasionally onerous cargo handling operation it is considered 
that the employment of hullstress monitors with approximately 
set threshold magnitudes for stress, or variations in stress, could 
provide a warning of events taking place and therefore provide 
some time for contingency action. 


Fig. 19 An example of hatch cover failure 


8.1 Hull Girder Strength 


8.1.1 The Effects of Hold Flooding on the Longitudinal 
Strength 


A study has been carried out to evaluate the effects of hold 
flooding on the longitudinal strength of a 138,000 DWT bulk 
with nine holds (Ref. 30) 
conditions have been studied, namely, heavy ballast, homoge 


carrier Three departure loading 


neous and ore loaded conditions. Only the results of the worst 
loading condition, i.e. the ore loaded condition, are presented 
here. The effects of reduction in scantlings due to corrosion 


have also been included in the study. Two damage scenarios 


were investigated 


Table 5 - Maximum still water bending moments and reserve strength for a 138,000DWT bulk carrier in flooded conditions 


Maximum S.W. 
Bending 
Moment 

(t-m) 

130867 
(sagging) 


Location 

from 

Midship 
(m) 

t 


Condition 


Ore Loaded 


: 10.38 
(undamaged) 


% of Assigned 
S.W. Bending 
Moment 


Reserve Strength 
Factor (F) 


Reserve Strength 
Factor (F) 

(Deck % Topside 
Tank Corroded) 


Reserve Strength 
Factor (F) 
(Whole Ship 


(No Corrosion) Corroded) 


44.3% 


Ore 336033.6 


(sagging) 


Loaded with 


N° 4 Hold Flooded 18.16 


113.8% 


1.649 1.275 1.256 


0.950 


274010.1 
(sagging) 
407203 

(Sagging) 


Ore Loaded with 
5 Hold Flooded 


Ore Loaded with 
N° 6 Hold Flooded 


10.38 


2.59 


92.8% 


1.029 


137.9% 


** Ore Loaded with N° 1 
& N° 2 Holds Flooded 


* Ore Loaded with N° 4 
& N° 5 Hold Flooded 


* Ore Loaded with N° 5 
& N° 6 Hold Flooded 


Factor F 


352540.5 
(hogging) 
526490.5 
(sagging) 
589393.3 
(sagging) 


33.72 


15,56 


Paths! 


: Fore Part of the Ship below Still Water Level 


119.4% 
| 178.4% 


| 199.7% 


a 


: Ratio of Ultimate Bending Moment to S.W. (actual) and Wave (assigned) Bending Moment 


: Fore and Aft Bulkheads of N° 4, N° 5 and N° 6 Holds are of Deep Tank Standard 


(1) One compartment flooding. 
(The ingress of water into an ore hold.) 


(2) Two compartment flooding 
(The ingress of water into an empty hold followed by the 
collapse of bulkhead making the adjacent hold with cargo 
flooded or vice versa.) 


The results of the study is shown in Table 5. The results show 
that the still water bending moment, when a midship cargo hold 
is flooded, can exceed the Rule permissible value. With one of 
the midship holds flooded, the reserve strength for wave bend- 
ing moment in the corroded ship is, in general, below the Rule 
requirements highlighting a possibility of failure in heavy 
weather. 

Hydrostatic calculations have indicated that the bow of the 
ship would be immersed below water when two of the forward 
most holds are flooded. This is not unusual for a B-60 type free- 
board ship which requires only single compartment flooded 
floatability. 


8.1.2 Ultimate Strength of Hull Girder 


The ultimate strength of the hull girder of the ship studied in the 
above section was assessed using Lloyd’s Register’s hull strength 
program. The sagging mode of hull girder failure which is consid- 
ered to be appropriate in this case has been investigated. 
Analyses have been carried out in the following three conditions: 


(1) Ship as built condition. 
(2) Ship with deck and topside tank corroded. 
(3) Whole ship corroded. 


The maximum allowable diminutions considered correspond 
to those specified in the Lloyd’s Register’s Survey Procedure 
Manual. The bending moment versus curvature curves for the 
three cases are shown in Fig. 20. The rapid unloading charac- 
teristics of these curves indicates that ultimate collapse can 
occur in a very short space of time once the ultimate strength 
is reached. The analyses have revealed that the sloped plating 
of the topside tank and the upper region of the transversely 
stiffened side shell are the weak links of the structure with 
regard to buckling. The buckling resistance can be improved 
by an increase in requirements in these regions and this is being 
considered in current Rule reviews. 
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Fig. 20 Vertical bending moment against curvature curve 


9, IMPROVEMENT OF RULES AND CO- 
OPERATION 


The results of casualty and damage investigations conducted 
by Lloyd’s Register have revealed that there are many possible 
factors associated with the recent losses of bulk carriers. The 
factors which had been discussed in the foregoing encompass 
the topics of design, operation, inspection and maintenance 
standards. However Lloyd’s Register recognises that a change 
in the Rules and survey procedures for existing ships and for 
new designs are necessary to ensure an increased robustness of 
the structure to cope with today’s harsh operating environments 
due to ever increasing commercial pressures. Rule proposals 
to achieve this were made and approved by the 1991 Autumn 
Technical Committee Meeting. 

The new Rule requirements affect the following structural 
components: 


(1) Main frame and it’s associated brackets 
— Minimum thickness, inertia and depth requirements 
for mainframes. 
— Increased arm lengths of top and bottom frame brack- 
ets. 
— Bracket detail design guidance. 
— Prohibited use of separate high tensile steel brackets. 
(2) Improved supporting structure in topside and hopper 
tanks. 
(3) Increased requirements for transverse bulkheads. 
(4) Improved scarphing arrangements at the fore and aft ends 
of cargo holds. 
(5) Increased frequency of surveys and reduced diminution 


allowances in service for existing tonnages. 


Lloyd’s Register has also been formulating recommendations 
affecting ship operational aspects and pursuing these matters 
through the International Association of Classification 
Societies (LACS). These efforts by Lloyd’s Register have 
resulted in the means to transfer hull damage data between 
member societies being set up together with the publication of 
an IACS guidance and information brochure for ship owners 
and operators on problems and remedies (Ref. 31). An [ACS 
unified approach for protective coatings in cargo holds is also 
being adopted. Guidelines for surveys and and assessment of 
structural condition are currently being developed for publica- 
tion. 

These developments will no doubt bring dividends on bulk 
carrier safety in the years to come. 
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10. PRACTICAL GUIDELINES ON 
SURVEYING AND REPAIRS 


The following notes are aimed at providing guidance on potential 
problem areas and practical guidelines on the survey of bulk 
carrier cargo holds and surrounding spaces together with exam- 
ples of some typical types of repairs that have been carried out. 


10.1 Access for Surveys 


The provision of satisfactory access and safety are two key 
elements which need to be given careful consideration prior to 
any survey being commenced.The Shipowners, Operators and 
Repairers are responsible for providing safe access and means 
for survey, and the Surveyors should only commence or continue 
a survey when they are satisfied with the access and safety 
arrangements provided. 

Some of the points which may be given consideration in the 
survey of bulk carriers are given as follows. 


10.1.1 Bulkhead Vertical Ladders 


Cargo hold bulkhead vertical ladders should be examined prior 
to descending to ensure that they are in good condition and that 
rungs are not damaged or loose. If the holds are entered with the 
hatch covers in the closed position then adequate lighting should 
be provided to illuminate the ladder area. Only one person at a 
time should descend the ladder as remains of cargo often become 
trapped behind ladder rungs and can become dislodged and fall. 


Fig. 21 Framework ladder in position in the cargo hold for a 
close-up examination of the lower and upper parts of side 
shell frames. Note that the ladder is locked in position at the 
top and bottom between the frame brackets by hydraulic 
rams and should also be wire lashed as a precautionary 
measure. A safety harness is provided with the ladder and 
attaches to a fixed guide built into the centre of the vertical 
portion of the ladder 


10.1.2. Australian Style Ladders 


Sloping (“Australian Style”) bulkhead ladders are prone to 
cargo handling damage and it is not uncommon to find plat- 
forms and ladders in poor condition with rails and stanchions 
missing or loose, especially if the hold is being entered after a 
recent discharge of cargo by grabs. 


10.1.3 Short Aluminium Ladder 


A short aluminium ladder is often used to gain access for close- 
up survey of the lower portion of the side shell frames and lower 
brackets. The ladder should be in good condition and fitted with 
adjustable feet to prevent it from slipping. Two crew members 
should be in attendance with the Surveyor in order that the base 
of the ladder is adequately supported during use. The remains 
of cargo, particularly fine dust, on the tank top should be brushed 
away as this can increase the likelihood of the ladder feet slipping. 


10.1.4 Extended/Articulated Ladders 


Ladders of this type (Fig. 21) are now being introduced by some 
Owners to enable a close-up examination of both the lower and 
upper portions of the side shell frames. This type of ladder has 
the advantage of a hydraulic locking system and a built in safety 
harness. The ladder and its hydraulics require to be maintained 
and inspected on a regular basis and this should be confirmed 
prior to use. 


10.1.5 Cherry Pickers 


Hydraulic arm vehicles (“Cherry Pickers”) are the most versa- 
tile means for carrying out a close-up examination of cargo hold 
bulkheads and upper parts of the cargo hold structure. These 
machines should be correctly maintained and driven by quali- 
fied personnel, and Surveyors should confirm this prior to using 
the machine. The standing platform should be fitted with a 
safety harness. For those machines equipped with a self level- 
ling platform, care should be taken that the locking device is 
engaged after completion of manoeuvring to ensure that the 
platform is fixed. This will eliminate the possibility of the plat- 
form tipping when the occupants move. 


10.1.6 Staging 


Staging is the most common means of access provided espe- 
cially where repairs or renewals are being carried out. It should 
always be correctly supported and fitted with handrails. Planks 
should be free from splits and lashed down. Staging erected 
hastily and by inexperienced personnel should be avoided. In 
topside and lower hopper tanks it may be necessary to arrange 
staging to provide close-up examination of the upper parts of 
the tank particularly the transverse web frames, especially 
where protective coatings have broken down or have not been 
applied. 


Fig. 22 Typical Bulk Carrier Cargo Hold Configuration 
showing areas to be given particular attention during inspections 
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10.1.7 Binoculars 


Binoculars can be used as an initial guide to view the topside 
structure in the cargo hold. They can be of assistance in giving 
the Surveyor an indication of areas which may require a close- 
up inspection. 


10.1.8 Tanks and Void Spaces 


Prior to entering tanks and void spaces they should have been 
properly ventilated and the oxygen content tested and 
confirmed as safe for access. A responsible member of the 
crew should remain at the entrance of the space and commu- 
nication established with both the bridge and engine room. 
Sufficient lighting, in addition to hand held lanterns, should 
be provided. In tanks which have recently been deballasted, 
a thin slippery film can often remain on the surfaces and care 
should be taken particularly on the topside tank sloping plat- 
ing. 


10.1.9 Ballast Trunks 


In bulk carriers fitted with vertical ballast trunks connecting 
the topside and lower hopper tanks, the trunks and associated 
hull structure are normally surveyed in conjunction with the 
tanks. Space within the trunks is very limited and access is by 
ladder or individual rungs which can become heavily corroded 
and in some cases detached or missing, and care needs to be 
taken when descending these trunks. 


10.1.10 Removal of Scale 


The removal of scale can be extremely difficult. When using 
a chipping or scaling hammer care should be taken to protect 
the eyes, and wherever possible safety glasses should be worn. 
The removal of scale by hammering may cause sheet scale, 
and in the case of cargo holds, residues of cargo to fall from 
above, this can also happen where cargoes are being 
discharged in adjacent holds by grabs and bulldozers making 
contact with the structure. If the structure is so heavily scaled 
that a satisfactory visual examination cannot be carried out 
then it will be necessary to request descaling. 


10.1.11 Surveys During Unloading Operation 


On some occasions Surveyors may be requested to carry out 
surveys from the top of the cargo. Surveys are not to be under- 
taken in this manner. 
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Fig. 24 


10.2 Inspections and Typical Repairs 


A typical bulk carrier cargo hold configuration showing areas to 
be given particular attention during inspections is depicted on the 
previous page in Fig. 22. The numbered areas for special attention 
are described in the following subsections. 


10.2.1 Inner Bottom (area 1) 


Cracks may be foundat the intersection of the bulkhead lower stool 
plating to the inner bottom and also at the intersection of the lower 
hopper tank sloping plating to the inner bottom (Figs. 23 & 24). 

This type of failure is more likely at the boundaries of the 
ballast hold and also in way of double bottom fore and aft girders. 
In order to reduce the possibility of these failures re-occurring, it 
may be necessary to consider fitting insert plates of increased 
thickness and/or a higher grade together with the addition of extra 
or increased scantling stiffeners in the double bottom, duck 
keels/pipe tunnels and lower hopper tanks. Welding in the struc- 
ture adjacent to the failure and the repair should be made full 
penetration wherever possible. 

Scallops in the floors and girders and cut outs for longitudinals 
should be fitted with pads and lugs respectively (Figs. 25, 26, 27 
& 28). Checks should also be carried out to ensure that the double 
bottom floors and girders are correctly aligned with the bulkhead 
lower stool and the lower hopper tank structure. Any misalign- 
ment should be corrected. Surveyors should also be guided by the 
arrangements shown in Fig. 7.8.2 of 1992 Rule Amendments 
Notice | and 2 (Fig. 29). 

The inner bottom plating should be examined for cracks in 
way of the corners of bilge wells and suctions, particularly where 
these are recessed into the bulkhead lower stools. Consideration 
can be given to repairing these by cropping and inserting cracked 
corners with plating of increased thickness and/or higher grades. 

The inner bottom plating, lower hopper tank sloping plating 
and bottom stool sloping plating are subject to cargo handling 
damage. This may cause buckling and distortion of the supporting 
structure below in double bottom, bottom stool and hopper tanks. 
These spaces should be internally examined when such damage 
is found. 
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Fig. 25 Insert Plate fitted to bulkhead lower stool plating 
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‘ig. 26 Stiffeners of increased depth and scantling being fitted in duct keel/pipe 
passage below bulkhead stool sloping plating 
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10.2.2 Bulkhead Connection to Stool (area 2) 


The bulkheads and lower stools, particularly at the boundaries 
of ballast holds, should be examined for cracks in the weld 
connection of the bulkhead to the lower stool shelf plate, shelf 
plate to stool sloping plating and in the bulkhead shedder plate 
welds. In the ballast holds water may become trapped behind 
cracked shedder plates and evidence of rust stains will indicate 
these areas (Fig. 30). Repairs should be made by cutting out 
the cracks and adopting full penetration welding. If the plating 
thickness in way of the crack is reduced through corrosion then 
it should be cropped and inserted.The alignment of the bulk- 
head plating to the lower stool structure should also be 
confirmed and any misalignment corrected. 

If it is evident that cracks are re-occurring from previous 
repairs then insert plates of increased thickness and/or grade 
should be fitted to the lower stool plating and the bulkhead 
plating. 


10.2.3 Bulkhead Plating (area 3) 


The transverse bulkhead plating should be examined for cargo 
handling damage and corrosion, particularly where protective 
coatings have broken down. Bulkheads at the boundaries of 
partial filling holds can also be buckled due to over- pressurisation. 

It should be noted that corrosion may be taking place simul- 
taneously on both sides of the bulkhead and the rate of 
diminution will be accelerated. Guidance on areas which 
require to have thickness measurement is shown in Fig. 31. 

The extent of thickness gauging should be sufficient to deter- 
mine the general condition of the bulkheads and the gauging 
locations should allow an accurate evaluation of any scantling 
diminution which may have occurred. 

FSD/CL/92/05/C (Ref. 32) gives guidance on the acceptable 
levels of diminution depending upon the bulkhead position and 
type, together with the type of reinforcement which may be 
fitted as an alternative to replacement. 


Fig. 30 Rust streaming mark from a crack 
(now repaired) in the bulkhead and the shedder plate in a 
water ballast hold 
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Cracks at the connection of the bulkhead to the topside tank 
sloping plating and the top stool should be repaired by adopting 
full penetration welding and the fitting of additional stiffening 
to the bulkhead troughs (Fig. 32). 

The alignment of the bulkhead plating with the topside tank 
structure should also be confirmed and any misalignment 
corrected. Cracks at the connection of the top stool to the topside 
tank (Fig. 32) may be repaired by adopting full penetration weld- 
ing and fitting an insert of increased thickness and/or grade. The 
scallop in the topside tank web should be closed by fitting a pad. 

The bulkhead connection to the side shell plating should be 
examined for evidence of grooving and cracks. Localised shallow 
grooving can be repaired by grinding the groove smooth and 
rewelding to the original plate thickness using a suitable elec- 
trode. More extensive grooving will require the structure to be 
cropped and renewed. 

Many bulk carriers are fitted with trunks which connect the 
topside and lower hopper tanks. These are built into the structure 
generally incorporating part of the transverse bulkhead. The 
trunks should be examined externally for signs of leaks at the 
junction with the topside and lower hopper tank sloping plating 
and internally for any deterioration of the coatings and grooving 
or cracking at their connection to the shell plating and at the 
connection of the bulkhead to the shell plating (Fig. 33). 

It is worth noting that trunks form part of the structural 
strength of the side shell. Where owners propose to remove 
trunks, for whatever reason, then advise should be sought from 
plan approval offices regarding the extent of compensation struc- 
ture which will require to be fitted. 

Examination of the above areas is particularly important in 
No | and No 2 cargo holds in way of the panting region, and at 


the forward bulkhead of No | hold where the rate and extent of 


grooving may be greater. 


The bulkhead top and bottom stools can have high levels of 


corrosion and wastage in way of the shelf plate and adjacent struc- 
ture, especially where the stools are used for ballast purposes. 
The lower stool shelf plate may also be affected by corrosion 
from water trapped behind cracked shedder plates in ballast 
holds ( see Fig. 34 overleaf). 

Oncompletion of repairs or renewals to the bulkheads, trunks 
and stool spaces the structure and welds should have a suitable 
protective coating applied or the original coating reinstated. 
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10.2.4 Side Shell Plating and Framing (area 4) 


The side shell plating and framing should be examined for 
grooving, cracks in welds or plates, corrosion and wastage, 
deformed frames and brackets, distortion and buckling of plat- 
ing and detached frames or brackets. 

The maximum allowable diminution of shell frames and 
brackets is 20% and renewals should be carried out where 
corrosion exceeds this limit. The initial thickness gaugings 
should be taken in those areas of frames and brackets as indi- 
cated overleaf in Fig. 35 with more readings being taken in way 
of the lower bracket and lower shell frame area as these parts 
of the structure are more prone to accelerated corrosion due 
to condensation and cargo entrapment. 

FSD/CL/91/03 (Ref. 35) gives guidance on the repair 
method to be adopted where the frame brackets have cracked 
at the connection to the lower hopper or topside sloping plating 
(see figs. 36 & 37 overleaf). Where cracking has occurred in 
association with corrosion and/or grooving then the opportu- 
nity should be taken to renew as much of the bracket as possible. 

Grooving, cracks and corrosion may be found where the 
lower part of the side shell frame connects to the side shell plat- 
ing. If the shell frame web is to be renewed, preferably it should 
be with increased thickness material. Any localised grooving 
found in the adjacent shell plating should be repaired by grind- 
ing out to asmooth profile and rewelding to the original plating 
thickness with a suitable electrode. More extensive grooving 
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will require the plating to be cropped and renewed. It is worth 

8 emphasising that grooving is potentially one of the most signif- 
icant problems as it can lead to detached or tripped frames and 
brackets, leaving the side shell unsupported with a consequent 
risk of side shell fractures. 

The use of pads or doublers as permanent repairs should be 
avoided, as they are ineffective and conceal the defective struc- 
ture making future examination impossible. 

Where cracks have occurred at the bracket connection to 
shell frame then consideration should be given to renewing the 
bracket with an increased arm length or the fitting of an addi- 
tional stiffener to the lower portion of the side shell frame 
(Figs. 38 & 39). The crack in the shell frame may be veed out 
and rewelded. The side shell plating should be examined for 
signs of grooving in way of the welded butts and seams, partic- 
ularly the erection seam immediately above the lower hopper 
tank sloping plate. 

Transition arrangements (scarphing brackets) fitted to the 
shell plating at the forward bulkhead in No | cargo hold should 
be examined for cracking in way of supporting brackets at the 
fore peak/forward deep tank bulkhead. Where cracks are found 
the brackets should be modified and extended at least a further 

e) frame space (Fig. 40). The side shell plating in the aftermost 
hold at the engine room bulkhead should be examined where 
continuation or extension brackets are fitted. NSI letter 90/2 
(Ref. 33) gives an example of a failure and repair in this area 
(see fig. 41 overleaf). 
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10.2.5 Hatchway Openings and Hatch Coamings (area 5) 


Cracks may be found in the deck plating at the corners of the 
hatchway openings and for repair, the deck should be cropped 
and inserted using plating of increased thickness and/or grade. 
The insert plate should be extended as far as possible to remove 


the new deck butt and seam away from the tangent points of 


the corner, especially where this is elliptical (Fig. 42). Doubler 
plates fitted to hatchway corners are not suitable as permanent 
repairs since they create stress concentrations and cracks may 
re-occur. Repair of cracks in these area by means of rewelding 
is not a satisfactory method. 


Consideration can be given to modifying the geometry of 


the corner from elliptical to radius depending upon the ship’s 
size and structural configuration. The criteria for radius corners 
is set out in the 1991 Rule Amendments, Notice 3, page 40, 
paragraph 4.3, see extract shown in Fig. 43. 

Cracks can be found where grab cables have grooved the 
plates and where chafing bars have been fitted to the deck. The 
use of chafing bars should be avoided as they can give rise to 
stress concentrations at their ends. NSI letter 89/4 gives a typical 
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4.3 Main cargo hatchway openings 


4.3.1 The following requirements apply to bulk camers 
with vertically corrugated transverse bulkheads in cargo holds 
having one or more of the following characteristics: 

(a) B240m 


fe] 
(0) 
(c) 


where B = mouided breadth of ship 
@ = width al deck of bulkhead top stool 
b = breadth of deck opening 
w = width of cross deck strip 
(fd) A Structural arrangement where the hatch side coaming 
and deck opening are arranged inboard of the top side 
tank 


2 2.2 


w 
= <0.2 where L 2 200m 


4.3.2 The corners of main cargo hatchways in the 
strength deck are to be rounded with a radius not less than x 
of the breadih of the opening, with a maximum radius of 
1000 mm. 


4.3.3 insert plates are to be fitted at the comers having 
a thickness not Jess than 25 per cent greater than the 
adjacent deck thickness outside the line of openings, with a 
minimum increase of 5 mm. See also 4.3.4. 

The corner inserts are to be extended trans- 
versely into the cross deck plating for a minimum dstance 
equal to 0.075, where b, is the breadth of deck opening. 


4.3.4 For the extreme comers of the end hatchways of 
the cargo region furthest from amidships the thickness of the 
comer insert plates is to be not less than 60 per cent greater 
than the adjacent deck thickness outside the line of 
openings. 


4.3.5 The steel grade for the comer inserts ts to be in 
accordance with Table 2.2.2 in Pt 3, Ch 2, comresponding to 
Class V. 
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example of a failure due to chafing bars (Fig. 44). Cracks can 
be found where shedder plates are fitted into the corners of the 
hatch coamings (Fig. 45). These shedders should be either 
attached by bolts, or if they are welded, the deck connection 
should be left unwelded. 

The hatch end transverse beams should be examined for 
corrosion and cracks. The cracks may be in the weld connection 
of the hatch end beams to the topside tank plating and also in 
way of the grain trimming holes. The cracks can be repaired by 
adopting full penetration welding and fitting pads to the grain 
trimming holes, an additional stiffener may also be fitted to the 
beam end bracket (Fig. 46). Where corrosion is found in asso- 
ciation with the cracks then the beam should be renewed using 
an insert of increased thickness and/or grade with the profile 
of the end bracket being modified and an additional stiffener 
fitted (Fig. 46). 
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Hatch coaming brackets, particularly end brackets, may be 
cracked at their toes with the crack propagating along the fillet 
weld and into the bracket web. These cracks do not generally 
spread into the deck plating. The toes of the brackets can be 
modified with a softer profile with full penetration welding to 
the deck being adopted for the bracket extension. The toe of 
the bracket should be aligned with existing structure or an addi- 
tional stiffener fitted (Fig. 47). 

Cracks may also be found in hatch coaming brackets in way 
of drainage scallops and cut outs for pipes and hydraulic lines. 
These cracks can generally be cut out and rewelded with addi- 
tional compensation doublers fitted around the scallops and cut 
outs. The hatch coaming plating should be examined for corro- 
sion, grab damage and cracks in way of any discontinuities 
especially cut outs around the toprail area. Coamings 
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Fig. 48 Additional brackets fitted to radius corner of hatch 
coaming. Note doubler previously fitted 
in way of cracked weld connection 


constructed with radius corners can have cracks in the welded 
corner connection to the deck. Repairing these cracks by fitting 
shaped doublers to the corners of the coamings will often result 
in the defect re-occurring. 

Consideration can be given to the fitting of additional fore 
and aft and athwartships brackets ensuring these align with 
existing structure under or extra stiffening should be fitted to 
the underdeck (Fig. 48). 


10.2.6 Cross Deck Strip between Hatchways (area 6) 


Plating inside the line of hatch openings should be examined 
for evidence of buckling, excess corrosion and pitting. Cracks 
and grooving are often found in the longitudinal weld connec- 
tion between the thinner plating inside the line of openings and 
the thicker upper deck plating. The underdeck structure of the 
cross deck strip should be examined as it can become heavily 
corroded or detached, causing buckling of the plating. 
Consideration can be given to fitting doublers to the cross 
deck strip plating (Fig. 49) where diminution levels do not 


S Upper Deck Plating 


Transitional 
} plate of 

/ intermediate 

thickness 


Cargo 


Ware argo 
. hold 


: Original 
hold } 


thickness 
cross deck 


\ plating 


Fig. 49 


exceed the maximum allowances, and the plating is not buckled. 
Doublers require to be efficiently connected by means of suffi- 
cient plug welds in way of the underdeck stiffeners. Where cross 
deck plating is being renewed consideration should be given to 
the fitting of a transitional plate of intermediate thickness 
(Fig. 50). 


Fig. 50 Cross Deck Doubling 


10.2.7 Topside Tanks (area 7) 


The most common defects in topside tanks are caused by corro- 
sion and wastage where the protective coatings and/or anodes 
have broken down or have not been maintained or fitted. 
Corrosion will be more accelerated where coatings have broken 
down in way of erection butts (Fig. 51), particularly manual 
welds. Coatings will also break down in areas of high stress 
concentration such as toes of brackets, intersections of longi- 
tudinals and stiffeners with primary supporting members, edges 
of openings and notches. These areas should be examined for 
signs of corrosion, cracks and buckling. It should be noted that 
varying degrees of corrosion can also be present in the same 
tank. This is more likely at the aft bulkhead area of the after- 
most topside tank adjacent to the engine room bulkhead, 
created by the hotter conditions in the engine room or bunker 
tank. 

Scale will build up behind the longitudinals on the sloping 
plating, blocking the drain holes. This should be cleaned away 
and the drain holes freed (Fig. 52). 

Particular attention should be given to the condition of the 
upper deck longitudinals, sheerstrake longitudinals and the top 
webs of the transverse ring frames. These areas should have a 
close-up examination as higher than average levels of corro 


Fig. 51 Breakdown of coatings at erection butts 


Fig. 52 Build up of scale behind sloping plate longitudinals 


sion-and diminution may be found and the longitudinals can 
be reduced in thickness adjacent to the weld connection due to 
“necking” (Fig. 53). 

The tank end bulkheads should be examined for wastage of 
plating and cracks at the bracket connections to deck, hopper 
plating and shell longitudinals. The bottom of the sloping plat- 
ing at its connection to the shell is also prone to wastage 
(Fig. 54). 
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Grooving may be found along the line of the sloping plating 
longitudinals and in some cases cracks occur in the plating and 
rust staining will be seen on the sloping plating when viewed 
from the cargo hold. Tanks where heavy scale has built up on 
the structure should be descaled prior to survey and thickness 
readings taken to determine the level of diminution. 

Cracks may occur at the transition of the deck, shell and 
sloping hopper tank longitudinals from high tensile to mild 
steel, and at a change of section where scarphing arrangements 
are introduced. 

The transverse web ring frame plating may be buckled at 
the positions shown overleaf in Fig. 55. The areas of buckled 
plating should be cropped and renewed using increased thick- 
ness plating and additionally stiffened to reduce the plate panel 
sizes. Lugs should also be fitted to all the longitudinals in way 
of the repairs and renewals. 
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Fig. 54 


Cracks and buckling may be found in way of the scarphing 
arrangements where the topside tank structure meets the 
engine room and the forepeak/forward deep tank bulkheads. 
The structure in this area can be misaligned and the toes of end 
brackets unsupported where sloping and horizontal structure 
on one side of the bulkhead crosses vertical structure on the 
reverse side (see fig. 56 overleaf). It may be necessary to remove 
existing brackets and stiffeners, fitting new scarphing brackets 
in line with the topside tank sloping plating (see fig. 57 overleaf). 
Unsupported structure should have adequate additional stiff- 
eners fitted and any misaligned structure corrected. 

Evidence of cracks can often be found when the topside tank 
sloping plating is observed from the forward and after holds 
and rust staining will be seen. 

All repairs and renewals should have suitable protective 
coating applied together with reinstatement of existing coatings 
where they have broken down. 


10.2.8 Hopper Tanks and Double Bottoms (area 8) 


The lower hopper tanks should be examined in the bilge strake 
area for cracks and corrosion at the erection butts. Cracks may 
be found at the connection of the sloping hopper plating to the 
side shell plating and at the connection of the sloping hopper 
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Fig. 55 Typical topside tank transverse web ring frame with three areas inserted using thicker material where 
buckling was found. Additional stiffeners added and extra lugs fitted to the longitudinals 
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plating to the inner bottom plating. Higher levels of corrosion 
and wastage are often found at the shell plating in way of bilge 
suctions and sounding pipes especially where the protective 
coatings have broken down. 

Cracks may be found where the transverse web ring frames 
connect to the side shell longitudinals. The cracks may be 
gouged out and rewelded, though in some cases it will be neces- 
sary to crop and part renew the longitudinal. Additional 
brackets can be fitted and toes of existing brackets modified 
(Fig. 58). The side shell longitudinals should also be collared at 
the cut outs in the web frames. 

Transition arrangements in way of the aft end at the engine 
room/oil fuel bunker tank bulkhead and at the forward end in 
way of the forepeak/forward deep tank bulkhead should be 
examined for cracks and buckling where any discontinuities 
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exist. Repairs in these locations are similar to those for the 
topside tank. 

It should also be noted that higher corrosion rates may be 
found in the structure adjacent to the engine room and bunker 
tanks due to temperature differentials. 

In the double bottom tank, cracks may be found in the inner 
bottom and bottom shell longitudinals beneath the bulkhead 
lower stools and also beneath bilge wells. These are more likely 
in way of the ballast holds. The cracks may be veed out and 
rewelded or the longitudinals cropped and renewed with addi- 
tional brackets being fitted (Fig. 59). 

The toes of existing brackets can be modified and any scal- 
lops in way closed by fitting pads (see fig. 60 overleaf). Part 3, 
chapter 10, section 5.2.3 of the Rules refers to the minimum 
distance of drain holes and scallops from the bracket toe ends. 
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10.3 General Comments 


During the course of surveys it will often be noted that areas 
of structure have previously been renewed and in many cases 
this will have been due to corrosion and wastage. It is particu- 
larly important to examine the original structure adjacent to 
renewed structure especially where protective coatings were 
not applied or re-instated at the time of the repairs. 

Accelerated diminution of the original structure beyond the 
renewal limit may have taken place in the interim period and 
it will be necessary to carry out further renewals together with 
sufficient thickness readings to determine the full extent of 
diminution. When surveyors are making recommendations on 
the extent of renewals for corrosion and wastage it is worth 
emphasising to Owners that in areas where the corrosion levels 
exceed 75% of the allowable limits, then renewals should be 
carried out or a suitable protective coating applied. In any event 
all renewals and the original structure should have suitable 
protective coatings applied. Evidence of buckling in corroded 
areas can also indicate structural diminution in excess of 
renewal limits. 

As a matter of course when any defect or failure is found on 
one side of the ship the same area should also be examined on 
the other side. 


10.4 Enhanced Surveys 


In view of recent dry bulk cargo ship losses, IMO Resolution 
A.713(17) requires the Classification Societies to develop 
survey and maintenance requirements for ships carrying solid 
bulk cargoes. The International Association of Classification 
Societies ([ACS) have now produced enhanced survey require- 
ments and these will be phased in from July 1993. 

The enhanced survey programme is intended to expand and 
emphasise the existing survey regulations at both the Special 
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Fig. 60 Typical fracture in bottom shell longitudinal in way of the toe of bracket 


and Intermediate Special Surveys and also at the Annual 
Survey. The survey focuses its attention upon the hull structure 
in the cargo hold length. The special survey will concentrate on 
close-up survey in association with thickness measurement and 
will require a comprehensive thickness measurement report to 
be placed onboard the ship. It will also require identification 
of what is termed “suspect areas” that is the structural areas 
which although below the normal renewal criteria are within 
25% of that allowed. These areas if not repaired at special 
survey will require to be placed on record for survey within the 
cycle. 

For Intermediate Special Survey there are new require- 
ments for the overall and close-up survey of cargo holds and 
ballast tanks including the re-examination and thickness 
measurements of any suspect areas. 

Annual Surveys may also incorporate inspections similar to 
that required at Intermediate Survey if the condition of the 
structure warrants this. Additionally, bulk carriers over 10 years 
of age will require an overall survey and close-up examination 
in all cargo holds. 


The importance of protective paint coatings is recognised in 
that the condition of coatings will be graded and recorded at 
Special Survey and the extent of future Annual Survey and 
Intermediate Special Survey will be dependent on the protec- 
tion afforded to the steelwork. 

It is important to emphasise the role of the Owner in the 
implementation of the enhanced survey regulations and the 
need for preparation of surveys, pre-planning of surveys and 
the provision onboard ship at all times of essential documen- 
tation. Preparation for surveys, that is cleanliness and access 
for close-up survey and thickness measurements, are important 
factors which now require attention as close-up survey areas 
and thickness measurement areas are closely related. 


6) 11. CONCLUSIONS 


Animportant conclusion reached was that the traditional struc- 
tural arrangements and scantlings, which were based on 
successful experience, can be vulnerable due to the combina- 
tion of factors associated with age and the increasing 
commercial pressures, unless specific measures in terms of 
inspection/maintenance and corrosion protection are taken. 

As one of the most disturbing findings from our investiga- 
tions was that ship operators believed that bulk carriers would 
inherently incur cracking and that these damages were sustain- 
able, it was of the highest priority that guidance be made 
available to the industry as a whole with regard to the potential 
consequences of certain types of damage. 

As the International Association of Classification Societies 
(LACS) members classify over 96% of the world fleet it was 
also considered logical that there should be some means for a 
member society to provide experience based warnings to other 
societies within the Association should the need arise, eg in the 
case of heavy localised corrosion of frame brackets this incident 
could be reported, so that other members could take contin- 
gency action. 

From the evidence available the following, also became 
evident: 


There is a need for an awareness in the ship operating 
community with regard to the possible consequence from 
damage to main frames, whether this is caused by cracking 
and corrosion or by the operational procedures practiced. 


¢ There isaneed to prevent corrosion occurring on the inter- 
nals of the side shell structure. 


¢ Bearing in mind the age statistics of the ships which were 
lost or heavily damaged it was considered logical to require 
an increase in survey requirements, for hold areas on older 
tonnage. 


¢ It would also seem logical to look to the future and ensure 
that new designs being constructed, particularly those with 
higher tensile steels, reflect the experience gained. 
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APPENDIX A 
Age Structure of the Fleet 


The age structure of the bulk carrier fleets is shown in Fig. A.1. 
From this figure it will be noted that the fleet is a reasonably 
balanced fleet in terms of size, up to about 1000,000 t dwt, for 
ships built between the early seventies and mid eighties. By far 
the majority of the ships which form the bulk carrier fleet are 
the handy sized ships ranging in age up to over 30 years. 


Statistics of Losses 


During the year 1990, twelve ships carrying dry bulk cargoes, 
where structural failure may have been a factor, were lost with 
a consequent reported loss of life of 200 seamen. Of the ships 
concerned eight were bulk carriers, two were ore carriers and 
two were ore or oil carriers. A number of major structural fail- 
ures to the primary hull girder members on bulk carriers which 
did not result in the loss of the ships also occured during this 
period. 

During 1991 thirteen ships with bulk carrier configuration 
have gone missing with additional loss of life. The majority of 
these ships were again carrying iron ore. 

To the end of 1992, three ships sank and five others were 

reported ass damaged, having leakages and fractures. 
Figs A.2, A.3and A.4 illustrate the loss of dry bulk carrying 
ships, during the period 1980 to 1992 where such losses can be 
attributed to structural failure, ie. ships which have had 
reported hull leakages or have simply gone missing. The ship 
types include single hull and double hull bulk carriers as well 
as ships with an ore carrier structural configuration. Over this 
period the average rate per year is about 6 ships with the highest 
level being of that attained during 1991 i.e. 13 ships. 


Size and Age of Bulk Carrier World Fleet as at 30th June 1992 
{including OBO's, Ore Carriers and Ore/oil Carriers) 
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Ships which have been lost or have known top have suffered 
significant damage during the period from the beginning of 
1990 to the time of writing are shown overleaf in Fig. A.5. From 
this information it can be deduced that the average age of the 
25 ships which were lost during 1990-1991 was about 19 years. 
with the majority being over 20 years of age. The average age 
being influenced by the loss of the ‘Mineral Diamond’ which 
was only 9 years old. From this information it will also be noted 
that most were carrying iron ore. In nearly all of the cases, 
except those where the ships have simply ‘gone missing’ it is 
understood that the loss was preceded by the water taken in 
one or more hold spaces. 


Bulk Carrier Losses Where Structural Failure May Have Been A Factor 
(1980 - Sept 92 ) 20,000 DWT Upwards ( inc. OBOs, Ore Carriers and Ore/Oil Carriers) 
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Bulk Carrier Losses Where Structural Failure May 
Have Been a Factor (1990 - Sept 92 ) 20,000 Dwt Upwards 
(inc. OBOs, Ore Carriers and Ore/Oil Carriers) 
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Bulk Carrier Losses Where Structural Failure May 
Have Been a Factor (1980 - Sept 92 ) 20,000 DWT Upwards 
(inc, OBOs, Ore Carriers and Ore/Oil Carriers) 
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From the information available for the handy sized ships it 
is evident that the rate of sinkings increases with age i.e. less 
than 1% for ships in the 5 to 9 age group ranging to 4% for the 
20 to 24 years group. In the case of larger ships the are indica- 
tions that this trend is still applicable with the 50,000 to 75,000 
t dwt group being up to about 7.5% when the ships are in the 
20-24 year age group. With regard to ships in the 100,000 to 
125,000 tdwt the very much small sample is relatively consistent 
in performance at about 7%. In considering the relevance of 
these magnitudes it requires to be recognised that these are 
note directly comparative in terms of numbers because of the 
great difference in sample numbers for the dwt ranges given. 
These percentages do, however, indicate a trend for the various 
deadweight ranges. 


In view of the difficulty in establishing probable causes for 
ships losses, information available with regard to bulk carriers 
with significant damages within the same time frame have also 
been included in these statistics. The information available indi- 
cate that cracking of the main frames and their brackets is a 
consistent occurrence. In certain cases this cracking has led to 
a reduction in support for the side shell which in turn has 
resulted in cracking occurring in the side shell plating itself. In 
at least two prominent cases this phenomenon actually led to 
the loss of the side shell plating over the affected hold lengths. 

These statistics used also seem to indicate that there are two 
distinct problem areas 1.e. one with the older ships and the other 
on a small scale with middle aged tonnage. 


Bulk, Ore/Oil, Ore & OBO Casualties - (Deadweight 20,000 tonnes) 
Missing, lost or serious Damage where structural failure may have been a factor, 
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